Privacy Policy

I. Introduction and Definitions

1. GENERAL

In operating our websites christmas-garden.de and presse.christmas-garden.de (hereinafter referred to individually and collectively as the “Website”), we process personal data. We treat this data confidentially and process it in accordance with applicable laws—in particular the General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG), and the Telecommunications and Digital Services Data Protection Act (TDDDG). With this Privacy Policy, we aim to inform you about what personal data we collect from you, for what purposes and on what legal basis we use it, and, where applicable, to whom we disclose it. In addition, we will explain the rights you have to protect and enforce your privacy.

2. DEFINITIONS

Our Privacy Policy contains technical terms found in the GDPR and the BDSG. To help you better understand them, we’d like to explain these terms in simple terms first:

2.1 Personal Data
“Personal data” refers to any information relating to an identified or identifiable natural person (Art. 4(1) GDPR). Examples of information relating to an identified natural person include a name or an email address. However, data is also considered personal if the identity is not immediately apparent but can be determined by combining our own information with information from third parties to identify the individual in question. For example, a person can be identified by their address or bank account information, date of birth, username, IP addresses, and/or location data. All information that in any way allows a person to be identified is relevant here.

2.2 Processing
Under Article 4(2) of the GDPR, “processing” refers to any operation or set of operations performed on personal data. This includes, in particular, the collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure, transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction of personal data.

II. Data Controller and Data Protection Officer

3. DATA CONTROLLER

The data controller is:
Company: Christmas Garden Deutschland GmbH “we”)
Legal representatives: Sebastian Stein; Lutz Grotehöfer
Address: Potsdamer Str. 58, 10785 Berlin
Phone: +49 30-81075-0
Email: info@christmas-garden.de

4. DATA PROTECTION OFFICER

We have appointed an external data protection officer for our company. You can contact him at:
Name: Reinher Karl
Address: HABEWI GmbH & Co. KG, Palmaille 96, 22767 Hamburg
Phone: +49 40 46008966
Fax: +49 40 46008977
Email: datenschutz@habewi.de

III. Processing Framework

5. PROCESSING CONTEXT: WEBSITE

In connection with the website, we process the personal data listed in detail below in Section IV. We process only data that you actively provide on the website (e.g., by filling out forms) or that you automatically provide when using our services.
Your data is processed exclusively by us and is generally not sold, lent, or disclosed to third parties. If we use external service providers to process your personal data, this is done within the framework of what is known as “order processing,” in which we, as the client, have the authority to issue instructions to our contractors. To operate our website, we use external service providers for hosting. We host our website with the external provider HostPress GmbH (address: Bahnhofstraße 34, 66571 Eppelborn) at data centers located in Losheim and Saarwellingen, Germany. If additional external service providers are used for specific processing activities listed in Section IV, they will be named there.
We do not transfer data to third countries and have no plans to do so. We will provide information regarding any exceptions to this principle in the processing activities described below. Any data transfers to third countries will then be carried out on the basis of the so-called EU Standard Contractual Clauses.

IV. Processing in Detail

6. WEBSITE HOSTING AND SERVER LOG FILES

6.1 Description of the Processing

Every time you visit the website, we automatically collect information that your browser transmits to our server. This includes the following data:
a) IP address
b) browser software used, including its version and language
c) operating system
d) the website from which visitors accessed the site (known as the referrer)
e) the subpages accessed on the website
f) the date and time the website was accessed
g) Internet service provider
h) the country and city from which a user visited the website
This information is also stored in our system’s log files. The temporary storage of your IP address by the system is necessary to deliver our website to a user’s device. For this purpose, the user’s IP address must be stored for the duration of the session. For security reasons—to defend against attacks on our website (particularly so-called DDoS attacks) and to prevent fraud—your IP address is also recorded in the log files.

6.2 Purpose
The data is processed to enable access to the website and to ensure its stability and security. In addition, the processing is used for statistical analysis and to improve our online services.

6.3 Legal Basis
The processing is necessary to safeguard the legitimate interests of the controller that prevail over the data subject’s interests (Art. 6(1)(f) GDPR). Our legitimate interest lies in the purpose specified in Section 6.2.

6.4 Retention Period
The data is deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. In the case of data collected for the purpose of providing the website, this occurs when the respective session ends. Log files are deleted by default after 7 days.

7. COOKIES

7.1 Description of Processing
Our website uses cookies. Cookies are small text files that are stored on the user’s device when visiting a website. Cookies contain information that enables the recognition of a device and, where applicable, certain website functions. We distinguish between our own cookies and external, so-called third-party cookies. Our site uses so-called “session cookies” and “persistent cookies.” “Session cookies” are automatically deleted when you end your internet session and close your browser. Persistent cookies remain stored on your device for a longer period of time. If cookies are technically necessary for the operation of our site, your consent is not required. All other cookies that are not technically necessary are only set after you have actively consented to the use of cookies via our consent tool. To obtain and document consent, we use the “Consentmanager” service, which is operated by consentmanager AB, Håltegelvägen 1b, 72348 Västerås, Sweden. The consent tool itself stores your selection in a cookie on your device. This means you won’t need to make a decision about cookies again on subsequent visits to our website.
You can find out which cookies are used on our website and for what purpose, how long they are stored on your device, and which consents you may have already provided by checking the settings in the Consentmanager consent tool.

7.2 Purpose
We use cookies to make our website more user-friendly and to provide the features described in Section 7.1.

7.3 Legal Basis
The processing is necessary with regard to technically necessary cookies, as well as the use of the consent tool, to safeguard the overriding legitimate interests of the controller (Art. 6(1)(f) GDPR in conjunction with § 25(2) TDDDG). Our legitimate interest lies in the purpose specified in Section 7.2. With regard to the processing of all other cookies—i.e., those that are not technically necessary—the legal basis is consent (Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG). Such consent is voluntary.

7.4 Retention Period, Withdrawal of Consent
Cookies are automatically deleted at the end of a session or upon expiration of the specified retention period. Since cookies are stored on your device, you, as the user, have full control over the use of cookies. By changing the settings in your web browser, you can disable or restrict the transmission of cookies. Cookies that have already been stored can be deleted. This can also be done automatically. If cookies for our website are disabled, deleted, or restricted, you may not be able to use certain features of our website at all, or only to a limited extent. You can revoke any consent you have given to the use of cookies at any time in the consent tool settings, effective for the future.

7.5 Recipients
When cookies are used, data may be transmitted to the respective providers of these third-party services. In some cases, this may also involve a transfer to third countries outside the European Union or the European Economic Area. We provide information about the recipients of data, as well as transfers to third countries, in the settings of the consent tool or in the relevant section regarding the third-party service in this Privacy Policy. Where applicable, personal data may be transferred to the service provider of the “Consentmanager” consent tool, consentmanager AB.

8. CONTACTING US BY E-MAIL

8.1 Description of Processing
You can also contact us using the email addresses listed on the website. To contact us, you can send us an email using the address listed on the website. In this case, we will process the personal data transmitted in the email.

8.2 Purpose
The data transmitted with and in your email will be used exclusively for the purpose of processing and responding to your inquiry.

8.3 Legal Basis
The processing is necessary to safeguard the legitimate interests of the controller that prevail over the interests of the data subject (Art. 6(1)(f) GDPR). Our legitimate interest lies in the purpose specified in Section 8.2. If the email contact is intended to conclude or fulfill a contract, the data processing is carried out for the purpose of fulfilling the contract (Art. 6(1)(b) GDPR).

8.4 Retention Period
We will delete the data as soon as it is no longer necessary to achieve the purpose for which it was collected. This is usually the case once the relevant communication with you has ended. Communication is considered concluded when the circumstances indicate that your matter has been fully resolved. If statutory retention periods prevent deletion, the data will be deleted immediately after the statutory retention period has expired.

9. NEWSLETTER

9.1 Description of Data Processing
We send out a newsletter at irregular intervals. Through the newsletter, we provide you with exclusive information on advance ticket sales, highlights at the Christmas Garden, raffles, and much more related to the Christmas Garden. You will only receive our newsletter if you actively subscribe to our mailing list. You can subscribe by filling out and submitting a newsletter sign-up form on our website.
To sign up for the newsletter, you only need to provide your email address. All other information (such as your first and last name) is optional and is used solely to personalize the emails. We use the so-called double opt-in procedure to process and verify newsletter sign-ups. The sign-up process consists of several steps. First, you sign up for the newsletter on our website. You will then receive an email from us at the email address you provided. In this email, we ask you to confirm that you have indeed signed up for the newsletter and wish to receive it. You confirm your subscription by clicking on a confirmation link contained in the email. Only after successful confirmation will we add you to our newsletter distribution list and send you emails in the future. As part of the double opt-in process, we store the date, time, and your IP address both at the time of registration and at the time of confirmation.

9.2 Purpose
Data is processed to provide the newsletter service and to send newsletter emails to subscribers. The collection and storage of the date, time, and IP addresses upon newsletter registration serve to document the consent given and to protect against the fraudulent registration of email addresses.

9.3 Legal Basis
Data processing for our subscriber newsletter is based on consent pursuant to Art. 6(1)(a) of the GDPR. You can access the consent form on the respective website or in the newsletter, for example at https://www.christmas-garden.de/berlin/newsletter/. Your consent is voluntary. The collection and storage of the date, time, and IP addresses upon newsletter registration is necessary to safeguard the legitimate interests of the controller that prevail (Article 6(1)(f) of the GDPR). Our legitimate interest lies in the purpose specified in Section 9.2.

9.4 Retention Period and Withdrawal of Consent
If you do not confirm your subscription to our newsletter within 24 hours of receiving the corresponding subscription email, your data will be automatically deleted. Otherwise, we process your personal data for the duration of your newsletter subscription. You can cancel your subscription to our newsletter at any time by withdrawing your consent. A simple statement is sufficient for this (via email to info@christmas-garden.de, or by mail to Christmas Garden Deutschland GmbH, Potsdamer Str. 58, 10785 Berlin). You can also unsubscribe from the newsletter by clicking the unsubscribe link in any newsletter email. Once you revoke your consent, you will no longer receive newsletters, and your personal data will be removed from our active mailing list.

9.5 Recipients and Transfer to Third Countries:
We use the services of the newsletter provider Brevo to manage our newsletter mailing list and send emails. This is done within the framework of data processing on our behalf. Brevo is a service offered by Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin. For more information on data protection at Brevo, please visit https://www.brevo.com/de/legal/privacypolicy/

10. SOCIAL NETWORKS

10.1 Description of Processing
Our website does not use so-called social media plugins. The Facebook, Instagram, TikTok, and YouTube logos displayed on our website are merely linked to our company’s corresponding profiles on the social networks. No data is transferred to the social networks when the logos are displayed. If you click on one of the logos, you will simply be redirected to the external website of the respective social network.
However, our profiles on social media platforms do constitute data processing. If you are logged into the respective social media platform while visiting one of our profiles, this information will be associated with your user account there. If you interact with our profile—for example, by commenting on a post, “sharing,” “liking,” or “retweeting”—this information will also be stored in your user account. We can generally view your interactions with our profile as well.
On our social media platforms, we use the “Insights” feature to obtain statistical data about the use of our social media pages. These statistics are provided by the respective social media platform. The “Insights” feature cannot be disabled. We cannot choose to enable or disable this feature. It is available to all page administrators, regardless of whether you use the Insights feature or not. Through Insights, we are provided with the following data for a selectable time period regarding fans, subscribers, people reached, and people who interacted: Total number of page views, “Likes” (including source), page activity, post interactions, reach, post reach (broken down into organic, viral, and paid interactions), comments, shared content, replies, and demographic analyses—specifically, country of origin, gender, and age. The Insights statistics do not allow us to identify visitors to our social media profiles or view their profiles.
The social networks you interact with store your data using pseudonyms as user profiles and use them for advertising and market research purposes. For example, this means you may be shown ads within the social network and on other third-party websites that correspond to your presumed interests. Cookies, which the social network stores on your device, are typically used for this purpose. You have the right to object to the creation of these user profiles; to exercise this right, you must contact the social networks directly.

10.2 Purpose
We maintain profiles on the aforementioned social networks for the purposes of public relations and corporate communications with customers and interested parties. We use the “Insights” feature on Facebook, Instagram, TikTok, and YouTube to analyze the reach of our posts on these social networks and to make them more engaging for our visitors in the future.

10.3 Legal Basis
The legal basis for data processing in connection with our social media profiles is the protection of our overriding legitimate interests (Art. 6(1)(f) GDPR). Our legitimate interest lies in the purpose specified in Section 10.2. If you are asked for consent by the respective social media platform operator, the legal basis is Article 6(1)(a) of the GDPR. Data processing regarding our presence on Facebook is carried out on the basis of joint controllership pursuant to Article 26 of the GDPR.

10.4 Recipients and Transfer to Third Countries
The respective social networks are operated by the companies listed below. For more information on data protection regarding our profile on these social networks, please refer to the linked privacy policies.
i) Facebook: Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. Privacy Policy: https://www.facebook.com/privacy/policy/?entry_point=data_policy_redirect&entry=0#applications
j) Instagram: Meta Platforms Ireland Limited, ATTN: Privacy Operations, Merrion Road, Dublin 4, D04 X2K5, Ireland, Privacy Policy: https://privacycenter.instagram.com/policy/?entry_point=ig_help_center_data_policy_redirect
k) TikTok: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland. Privacy Policy: https://www.tiktok.com/legal/page/eea/privacy-policy/de
l) YouTube: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, YouTube/Google Privacy Policy: https://policies.google.com/privacy

Social media platforms also process your personal data in the United States.

11. GOOGLE ANALYTICS

11.1 Description of Processing
Our website uses “Google Analytics,” a web analytics service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter referred to as “Google”). Google Analytics uses cookies (see Section 7) that enable an analysis of your use of our website. The information generated by the cookies is generally transmitted to a Google server in the United States and stored there. However, we use Google Analytics exclusively with IP anonymization enabled. This means that your IP address is truncated by Google within member states of the European Union or in other signatory states to the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the United States and truncated there. The IP address transmitted by your browser as part of Google Analytics is not merged with other Google data. The statistics generated by Google Analytics track, in particular, how many users visit our website, from which country or location access occurs, which subpages are accessed, and through which links or search terms visitors arrive at our website. The Google Analytics Terms of Service can be found at https://policies.google.com/terms. An overview of data protection for Google Analytics is available at https://support.google.com/analytics/answer/6004245?hl=de. Google’s Privacy Policy can be viewed at www.google.de/intl/de/policies/privacy.

11.2 Purpose
Data is processed to enable us to analyze the use of our website. The information obtained in this way is used to improve our online presence and tailor it to user needs.

11.3 Legal Basis
The processing is based on consent pursuant to Article 6(1)(a) of the GDPR. We obtain this consent through the consent tool (see Section 7.1). Such consent is voluntary.

11.4 Retention Period and Right to Object, Withdrawal of Consent
We have explained the retention period, as well as your options for controlling and configuring cookies, in Section 7.4. You may withdraw the consent you have provided for Google Analytics at any time in the Consent Tool settings, effective for the future. Alternatively, you can object to data processing by Google Analytics at any time by downloading and installing the browser add-on provided by Google at tools.google.com/dlpage/gaoptout?hl=de. We automatically delete the analytical data processed and stored using Google Analytics after 14 months.

11.5 Recipients and Transfer to Third Countries
According to the German data protection supervisory authorities (Data Protection Conference), Google Analytics acts as a joint controller in the processing of data on our behalf. In light of this, we have also entered into the “Google Measurement Controller-Controller Data Protection Terms” with Google. Google also processes your personal data in the United States.

12. GOOGLE WEBFONTS

12.1 Description of Processing
Our website uses “Google Web Fonts,” a font replacement service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter referred to as “Google”). When our website is displayed, Google Web Fonts replaces the default fonts on your device with fonts from Google’s catalog. If your browser blocks the integration of Google Web Fonts, the text on our website will be displayed using your device’s default fonts. The Google fonts are loaded directly from a Google server. To enable this, your browser sends a request to a Google server. As a result, your IP address may also be transmitted to Google in conjunction with our website’s address. However, Google Web Fonts does not store any cookies on your device. According to Google, data processed as part of the Google Web Fonts service is transferred to resource-specific domains such as fonts.googleapis.com or fonts.gstatic.com. It is not associated with data that may be related to the use of other Google services, such as the Google search engine or Gmail. For more information on data protection for Google Web Fonts, visit https://developers.google.com/fonts/faq/privacy?hl=de. General information on data protection at Google is available at policies.google.com/privacy?hl=de-DE.

12.2 Purpose
: The data is processed to make the text on our website easier to read and more visually appealing.

12.3 Legal Basis
The processing is necessary to safeguard the legitimate interests of the controller that prevail over the data subject’s interests (Art. 6(1)(f) GDPR). Our legitimate interest lies in the purpose specified in Section 12.2.
12.4 Recipients and Transfer to Third Countries
The use of Google Web Fonts may result in the transfer of personal data to Google. Google also processes your personal data in the United States.

13. GOOGLE ADS CONVERSION

13.1 Description of Processing
Our website uses the advertising service “Google Ads Conversion,” which is operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter referred to as “Google”). With the help of Google Ads Conversion, we can place ads on external websites to draw your attention to our offerings there. In addition, this service enables us to determine the reach and success of individual advertising campaigns. Our ads are delivered by Google via so-called “ad servers.” To do this, Google uses so-called “ad server” cookies, which measure certain performance metrics, such as the number of times ads are displayed or the number of clicks by users. If you arrive at our website via a Google ad, Google Ads will store a cookie on your device (see Section 7). According to Google, these cookies are not intended to identify you personally. The following analytics data is typically stored in connection with this cookie: the unique cookie ID, the number of ad impressions per placement (frequency), the last impression (relevant for post-view conversions), and opt-out information (an indicator that the user no longer wishes to be targeted). These cookies enable Google to recognize your web browser. If you visit the websites of a Google Ads customer and the cookie stored on your device has not yet expired, Google and the customer can recognize that you clicked on the ad and were redirected to our website. Each Google Ads customer is assigned a different cookie. Cookies cannot therefore be tracked across the websites of Google Ads customers. We ourselves do not process any personal data through our Google Ads advertising campaigns. Google merely provides us with statistical reports. Based on these reports, we can determine which of the advertising measures used are particularly effective. We do not receive any further data from the use of these advertising tools; in particular, we cannot identify users based on this information. When you visit our website, a connection to Google’s servers is therefore established. We have no influence over the scope and further use of the data collected by Google through the use of Google Ads Conversion and therefore inform you to the best of our knowledge: Through the integration of Google Ads Conversion, Google receives information about which subpage of our website you visited or which of our ads you clicked on. If you are registered with a Google service, Google can associate the visit with your account. Even if you are not registered with Google or are not logged in, it is possible that Google may obtain and store your IP address.

For more information about Google's privacy practices, click here: policies.google.com/privacy?hl=de.

13.2 Purpose
The data is processed to deliver targeted online advertising for our own offerings and to evaluate its effectiveness and reach.

13.3 Legal Basis
Data processing is based on consent pursuant to Article 6(1)(a) of the GDPR. We obtain this consent using the “Consentmanager” consent tool (see Section 7.1). Such consent is voluntary.

13.4 Retention Period and Right to Object, Withdrawal of Consent
We have explained the retention period, as well as your options for controlling and configuring cookies, in Section 7. You may also object to data processing by Google Ads Conversion at any time via the following website: https://policies.google.com/privacy?hl=de. You may revoke the consent you have provided regarding data collection by Google Ads Conversion at any time in the Consent Tool settings, effective for the future.

13.5 Recipients and Transfer to Third Countries
Due to the integration of Google Ads Conversion, personal data may be transferred to Google. Google also processes your personal data in the United States.

14. GOOGLE TAG MANAGER

Our website uses “Google Tag Manager,” a service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter referred to as “Google”). Google Tag Manager does not collect any personal data or set any cookies. This service merely enables us to integrate and manage tags on our website. Tags are small pieces of code on our website that help us use other tools to, for example, measure traffic and visitor behavior, track the impact of online advertising and social media channels, implement remarketing and target specific audiences, and test and optimize the website. For more information about Google Tag Manager, visit https://support.google.com/tagmanager/answer/9323295?hl=de#.

15. CHATBASE

15.1 Description of Processing
Our websites use a chatbot from Chatbase (https://www.chatbase.co) provided by Chatbase.co Inc., 4700 Keele Street, 215 Bergeron Centre, Toronto, ON, Canada, M3J 1P3. Chatbots can respond to your questions about our services and other input without human assistance. To do this, the chatbots analyze not only your input but also other data in order to provide appropriate responses (e.g., names, email addresses, and other contact information; customer numbers and other identifiers; orders; and chat histories). Furthermore, the chatbot may collect your IP address, log files, location information, and other metadata.

15.2 Purpose
User profiles may be created based on the collected data. In addition, the data may be used to display interest-based advertising, provided that the other legal requirements (in particular, your consent) are met. To this end, the chatbots may be linked to analytics and advertising tools. The collected data may also be used to improve our chatbots and their response behavior (machine learning).

15.3 Legal Basis
The legal basis for the use of the chatbot is Article 6(1)(b) of the GDPR, provided that the chatbot is used for the purpose of entering into a contract or in connection with the performance of a contract. If consent has been obtained, processing is carried out exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG, to the extent that the consent covers the storage of cookies or access to information on the user’s device (e.g., device fingerprinting) within the meaning of the TDDDG. Consent may be revoked at any time. In all other cases, the use of cookies is based on our legitimate interest in ensuring the most effective customer communication possible (Article 6(1)(f) of the GDPR).

15.4 Retention Period
The data you enter during communication will remain with us or the chatbot operator until you request that we delete it, revoke your consent to its storage, or the purpose for storing the data no longer applies (e.g., after your request has been processed).

15.5 Recipient and Storage Location
This data is stored on the chatbot provider’s servers in the United States. For more information on how user data is handled, please see Chatbase’s Privacy Policy: https://www.chatbase.co/legal/privacy.

16. SERVER-SIDE TRACKING (TAGGRS)

16.1 Description of Processing
We use server-side tracking on our website. To this end, we operate a server-side Google Tag Manager (a so-called “server container”), which is hosted for us by TAGGRS B.V., K.R. Poststraat 131, 8448 EB Heerenveen, Netherlands (hereinafter referred to as “TAGGRS”). The server container runs under a first-party subdomain of our website. When you use our website, the client-side page views and events (in particular, the page views and events from our Google Analytics 4 tracking) are no longer transmitted directly to the servers of the respective providers (e.g., Google), but are first sent to our own server container. There, the events are processed and—exclusively with your consent—forwarded to the connected target platforms, namely Google Analytics 4 (GA4) and, for defined events, the Meta Conversions API. Once you have given your consent for GA4 tracking, the server container processes, in particular, the usage data collected as part of GA4 tracking, as well as data that is automatically generated by the browser architecture and communication with servers (e.g., IP address, user agent, and information about your browser and operating system). Before being transmitted to Google Analytics, your IP address is truncated via the server-side Google Tag Manager (by masking the last two digits), making direct identification more difficult. In addition, we use Google Consent Mode v2, which links the behavior of the embedded tags to your consent decision. TAGGRS acts exclusively as a hosting service provider for us and thus as a data processor; TAGGRS is not an independent recipient of the data for its own purposes. You can find more information about data protection at TAGGRShere.

16.2 Purpose
The processing serves to ensure reliable, consent-based collection and transmission of usage data for the purpose of measuring the reach and effectiveness of our advertising campaigns, as well as to enable a centrally controllable and more data-efficient transmission architecture (for example, by truncating the IP address and implementing server-side control of data forwarding linked to consent). The specific analytics and advertising purposes of the target platforms are outlined in the respective sections on Google Analytics, Google Ads, and Meta.

16.3 Legal Basis
Processing is based on consent pursuant to Art. 6(1)(a) of the GDPR in conjunction with § 25(1) of the TDDDG, as the underlying client-side data collection involves accessing or storing information on your device. We obtain this consent through our consent tool, “Consentmanager.” Server-side transmission to the target platforms (in particular GA4 and the Meta Conversions API) is contingent upon this consent; without your consent, no data will be transmitted to the aforementioned recipients. Such consent is voluntary. The legal bases for processing by the respective target platforms are set forth in their separate sections within this Privacy Policy.

16.4 Retention Period and Withdrawal of Consent
At the hosting level—that is, within the server container provided by TAGGRS—the data is stored for a period of 30 days. The retention period in the target tools where the data is ultimately aggregated (e.g., Google Analytics) is generally longer and is governed by the separate sections on the respective services. We have explained the retention period as well as your control and customization options regarding cookies and other tracking technologies in the section on cookies. You can revoke the consent you have provided at any time in the settings of the “Consentmanager” consent tool, effective for the future.

16.5 Recipients and Transfers to Third Countries
TAGGRS B.V. acts on our behalf as a data processor pursuant to Article 28 of the GDPR and provides only the hosting infrastructure for the server container. TAGGRS uses subprocessors for hosting. According to the provider, hosting takes place exclusively within the European Union. No transfer to third countries occurs at the hosting level by TAGGRS. The actual recipients of the data forwarded from the server container remain Google and Meta. They process the data under their own responsibility based on their respective legal grounds; any associated transfers to the U.S. are carried out based on the EU-U.S. Data Privacy Framework or based on the EU Standard Contractual Clauses pursuant to Article 46(2)(c) of the GDPR.

V. Security Measures

16. SAFETY MEASURES

To protect your personal data from unauthorized access, we have secured our website with an SSL or TLS certificate. SSL stands for “Secure Sockets Layer” and TLS for “Transport Layer Security”; these protocols encrypt data communication between a website and the user’s device. You can recognize active SSL or TLS encryption by a small padlock icon displayed on the far left of the browser’s address bar.

VI. Your Rights

17. DATA SUBJECT RIGHTS

With regard to the data processing by our company described above, you have the following rights as a data subject:

17.1 Right of Access (Art. 15 GDPR)
You have the right to request confirmation from us as to whether we process personal data concerning you. If this is the case, you have the right, subject to the conditions set forth in Art. 15 GDPR, to access this personal data and to receive the information specified in Art. 15 GDPR.

17.2 Rectification (Art. 16 GDPR)
You have the right to request that we promptly rectify any inaccurate personal data concerning you and, where applicable, complete any incomplete personal data.

17.3 Erasure (Art. 17 GDPR)
You have the right to request that we erase personal data concerning you without delay if any of the reasons specifically listed in Art. 17 GDPR apply, e.g., if your data is no longer necessary for the purposes we pursue.

17.4 Restriction of Data Processing (Art. 18 GDPR)
You have the right to request that we restrict processing if any of the conditions listed in Art. 18 GDPR are met; for example, if you dispute the accuracy of your personal data, data processing will be restricted for the period necessary to allow us to verify the accuracy of your data.

17.5 Data Portability (Art. 20 GDPR)
You have the right, subject to the conditions set forth in Art. 20 GDPR, to request that the data concerning you be provided to you in a structured, commonly used, and machine-readable format.

17.6 Withdrawal of Consent (Art. 7(3) GDPR)
You have the right to withdraw your consent at any time with regard to processing based on consent. The withdrawal takes effect from the time it is asserted. In other words, it applies prospectively. Thus, the processing does not become unlawful retroactively as a result of the withdrawal of consent.

17.7 Complaint (Art. 77 GDPR)
If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority. You may exercise this right with a supervisory authority in the EU member state where you reside, where you work, or where the alleged violation occurred.

17.8 Prohibition of Automated Decision-Making/Profiling (Art. 22 GDPR)
Decisions that produce legal effects concerning you or significantly affect you may not be based solely on automated processing of personal data—including profiling. We hereby inform you that we do not use automated decision-making, including profiling, with respect to your personal data.

17.9 Right to Object (Art. 21 GDPR)
If we process your personal data on the basis of Art. 6(1)(f) GDPR (to safeguard overriding legitimate interests), you have the right to object to such processing under the conditions set forth in Art. 21 GDPR. However, this applies only to the extent that there are grounds arising from your particular situation. Following an objection, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms. We are also not required to cease processing if it serves to assert, exercise, or defend legal claims. In any case—even regardless of a specific situation—you have the right to object at any time to the processing of your personal data for direct marketing purposes.

As of June 2026