Privacy policy for our website

Fundamentals

We provide this information in order to transparently explain how we handle your personal data (which, according to supreme court rulings, also includes your IP address) when you visit our website. According to Art. 4 No. 1 GDPR, personal data is any information relating to an identified or identifiable natural person.

Privacy policy and information

We take the protection of your data and your privacy very seriously and comply with our obligations under data protection laws. We collect and process your personal data in accordance with European and national legal requirements. This Privacy Policy explicitly explains how and in what form we process your data. When you visit our website, we are required to collect certain personal data—this serves, on the one hand, to ensure the functionality of our website and, on the other hand, to enhance the user experience through the use of various tools. Furthermore, we would like to point out that data transmission over the Internet is not possible without accepting the risk of potential security vulnerabilities. While we cannot guarantee complete protection of your data, we make every effort to protect your data comprehensively.

Why do we need your data?

Your data is collected so that we can display our website correctly. Other data may be used to analyze your user behavior. Furthermore, data collection is based on a legal basis: If you have consented to data processing, we process your personal data pursuant to Article 6(1)(a) of the GDPR or Article 9(2)(a) of the GDPR if sensitive data is processed in accordance with Article 9(1) of the GDPR. The processing of data under Article 9 of the GDPR is permitted only in certain cases. If you have consented to the storage of cookies or to access to information on your device—such as through device fingerprinting—data processing is carried out on the basis of Section 25(1) of the TDDDG. You may revoke your consent at any time with future effect. You may revoke your consent by sending us an informal notice via email. You may also contact our Data Protection Officer, who will forward your request to us. However, the lawfulness of the data processing carried out prior to the revocation remains unaffected by your revocation. If we collect your data to fulfill a contract or to take steps prior to entering into a contract, your data is processed on the basis of Article 6(1)(b) of the GDPR. If your data is necessary to comply with a legal obligation, we process your data on the basis of Article 6(1)(c) of the GDPR. Data processing may also be based on our legitimate interest in processing the data. In this case, data processing is permitted provided that your interests or the interests of third parties do not conflict with the processing. In such cases, data processing is carried out in accordance with Article 6(1)(f) of the GDPR. We will specify the applicable legal basis for each individual case in the relevant section.

Who is responsible?

As the operator of this website, we are the data controller responsible for data processing on our website under data protection law, in accordance with Article 4(7) of the GDPR. You can reach us using the following contact information: Gams Hotel Resort Bad Hindelang Kur- und Sporthotel Appartementhaus GmbH Gunther M. Gebauer Zillenbachstraße 50, 87541 Bad Hindelang Phone: +49 8324 9840 Email: info@die-gams.de

How to contact our data protection officer

#KOMM#IT, Funke Solution GmbH & Co. KG, Salmas 52, 87534 Oberstaufen Tel: +49 8325 927050, dsb@komm-it.info

How long do we store your data?

We adhere to the applicable statutory retention period regarding the maximum duration of storage of your personal data. We will store your data only until we no longer need it for our data processing purposes. We are bound by the purpose for which we collected your data when it comes to storing it. Unless a specific retention period is stated in this notice, your personal data will remain with us until the purpose for data processing no longer applies. If you submit a valid request for erasure or revoke your consent to data processing, we must erase your data unless there are other legally permissible grounds for continuing to store your data, such as retention periods under commercial and tax law. We can only comply with your request for erasure once these grounds no longer apply.

Where do we get your data from?

We collect your data because you provide it to us via a contact form or by other means. There is additional data that is collected automatically or only after your consent when you visit our website. This is primarily technical data such as your operating system and the time at which you accessed the page.

Who do we make your data available to?

We use tools from third-party companies based both within and outside the EU and the EEA. Your personal data may be transferred to these third parties if you have enabled these tools—unless they are necessary for the website to function. Furthermore, we also use tools from companies based in the United States or other third countries that do not provide an adequate level of data protection. Your personal data may also be transferred to these companies if you have enabled the corresponding tools. These countries do not have a level of data protection comparable to that of the EU. Such a data transfer requires an adequacy decision issued by the European Commission that ensures a comparable level of protection for your personal data. In the event that no such adequacy decision exists, other appropriate safeguards must be put in place in accordance with Art. 44 et seq. of the GDPR.

How is money handled on this website?

On our website, we offer the option to enter into a paid contract directly. In order to fulfill this contract and process the payment, you are required to provide us with your payment information. This payment information includes your account number, IBAN, BIC, account holder name, credit card number, expiration date, and any other details required for the payment. Transactions using common payment methods such as Visa, MasterCard, or direct debit are processed exclusively via an encrypted SSL or TLS connection. You can recognize an encrypted connection by the fact that the browser’s address bar changes to https://. You can also recognize it by the padlock icon in your browser’s address bar. With encrypted communication, your payment information generally cannot be read by third parties.

What rights do you have? - Your rights as a data subject

You can assert your rights in accordance with Art. 12 et seq. GDPR.

Withdrawal of consent to data processing

In some cases, we process your data with your express consent. You can revoke any consent you have already given at any time with effect for the future. You can revoke your consent by sending us an informal e-mail. You can also contact our data protection officer, who will inform us of your request. However, the legality of the data processing carried out until the revocation remains unaffected by the revocation exercised by you.

Objection in special cases / against direct advertising, Art. 21 GDPR

If data processing is based on Article 6(1)(f) of the GDPR, you may object to the processing of your personal data on grounds relating to your particular situation. This also applies to any profiling—the legal basis for such profiling is set forth in this notice. If you exercise your right to object, your personal data in question will no longer be processed, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims pursuant to Article 21(1) of the GDPR. If we process your personal data for direct marketing purposes, you have the right to object to the processing of your personal data for such marketing purposes. This also applies to profiling to the extent that it is related to direct marketing. If you object, your personal data will no longer be used for direct marketing purposes pursuant to Article 21(2) of the GDPR.

Right to data portability

You have the right to have data that we process automatically handed over to you or to a third party in a commonly used, machine-readable format. If you request the transfer of the data to another controller, this will only take place if it is technically feasible.

Right to information, erasure and rectification

In accordance with Art. 15 (1) GDPR, you have the right to request information free of charge about your stored personal data, its origin, recipients and the purpose of data processing. You may also have the right to have this data rectified or erased. If you have any questions about your rights, you can contact us or our data protection officer at any time.

Right to restriction of processing

You may also request that the processing of your personal data be restricted. If you have any questions about this right, you may contact us or our Data Protection Officer at any time. The right to restriction applies in the cases specified by law. If you dispute the accuracy of your data, we need time to verify it. For this period, you have the right to request that the processing of your data be restricted. If your data is being processed unlawfully, you may request restriction of processing instead of erasure. If we no longer need your personal data but you wish to exercise, defend, or assert legal claims, you have the right to request, at a minimum, the restriction of data processing. If you have lodged an objection pursuant to Article 21(1) of the GDPR, we must balance your interests against ours; during this period, you have the right to request the restriction of data processing. If you have restricted the processing of your personal data, such data—apart from its storage—may be processed only with your consent or for the purpose of asserting, exercising, or defending legal claims, or to protect the rights of another natural or legal person, or for reasons of an important public interest of the European Union or a Member State.

Right to lodge a complaint with a competent supervisory authority

As a data subject, you also have the right to lodge a complaint with a supervisory authority in the event of breaches of the GDPR. This must be the competent data protection supervisory authority in your federal state. You always have the right to lodge a complaint, regardless of what other measures you take.

Further information

We expressly object to the sending of unsolicited advertising and informational materials to our contact information. We expressly reserve the right to take legal action against the unsolicited sending of advertising, such as through spam emails. For security reasons and to protect the transmission of confidential content, we use an SSL or TLS connection. You can recognize an encrypted connection by the fact that the browser’s address bar changes from “http://” to “https://” and by the padlock icon in your browser’s address bar.

Server log files

The website provider collects and stores information in server log files that your browser automatically transmits to us. This includes the following data: browser type and version, operating system used, referrer URL, hostname of the accessing computer, time of the server request, and your IP address. Your data is not combined with data from other sources. The legal basis for data processing is Article 6(1)(f) of the GDPR, as we, as the website operator, have a legitimate interest in the technically error-free display and optimization of our website. Server log files must be collected for this purpose.

Hosting of our website

We host our website with an external provider. Strato GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin All personal data collected on the website—such as your IP address, metadata and communication data, contractual data, contact information, names, website visits, and other data generated through the website—is stored on the host’s servers. The legal basis for the processing of your personal data is Article 6(1)(f) of the GDPR. Our legitimate interest lies in ensuring that our website is displayed as reliably as possible. In the event that we have requested your consent, the processing of your data is based on Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG, provided that the use of the data is subject to consent for the storage of cookies or access to information on the user’s device—such as device fingerprinting—as defined by the TDDDG. Consent may be revoked at any time with future effect. You may revoke your consent by sending us an informal notice via email. You may also contact our Data Protection Officer, who will forward your request to us. However, the lawfulness of the data processing carried out up to the time of revocation remains unaffected by your revocation. To demonstrate compliance with data protection regulations and to outline our respective obligations, we have entered into a data processing agreement. This is a contract required by data protection law pursuant to Article 28(3) of the GDPR, which ensures that our data processor processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

Setting of cookies

We use cookies on our website. These are small text files and data packets that are stored on your device but do not cause any harm. Cookies are stored on your device either temporarily for a single session (session cookies) or permanently (persistent cookies). Session cookies are automatically deleted at the end of the session, whereas persistent cookies remain on your device until you delete them yourself or your web browser automatically deletes them. In some cases, cookies from third-party providers may also be stored on your devices; these are known as third-party cookies. They enable the use of services provided by these companies, such as cookies used to process payment services. Cookies serve various functions. Some are technically necessary for certain applications on the website to function at all, such as the shopping cart feature. Other cookies are used to analyze user behavior on our site or to display advertisements. Cookies that are technically essential and are therefore considered necessary cookies are stored in accordance with Section 25(2) of the TDDDG, unless another legal basis is explicitly specified. Storing cookies is absolutely necessary to create the technical conditions for a flawless and optimized website. For cookies that are not technically essential, consent is requested in accordance with §25(1) TDDDG. In such cases, cookies are stored solely on the basis of this consent. Consent may be revoked at any time with future effect. You may revoke your consent by sending us an informal notice via email. You may also contact our Data Protection Officer, who will forward your request to us. However, the lawfulness of data processing carried out prior to revocation remains unaffected by your revocation. You can configure your browser to notify you when cookies are set and to allow them only on a case-by-case basis. Furthermore, you can generally disable the storage of cookies and enable their automatic deletion when you close your browser. We recommend this approach. If you disable cookies entirely, the functionality of our website and its display may be limited. We will provide you with separate information regarding the use of third-party cookies and cookies for analytical purposes. In such cases, we will also request your consent.

Cookie banner on the homepage:

Our cookie banner on the homepage (consent request) is provided by a third-party vendor. We use the cookie banner to obtain your consent to allow certain cookies—which are not necessary for the technical display of the website—to be stored on your device. We need this consent to establish a legal basis for storing these cookies. When you visit our website, personal data is transmitted to our cookie banner provider. This data includes the following: your response to our consent request via the cookie banner, your IP address, information about your browser and device, and the time of your visit to our website. When you access our website, a connection is established with the provider’s servers so that your consents or other declarations regarding the use of cookies can be obtained. Once you have made your declaration, our provider stores a cookie in your web browser so that it can determine whether you have consented to the use of cookies or have rejected them. It also serves to track any subsequent revocation of consent. This data is stored until you request that we delete it, delete the cookie yourself, or the purpose for data processing no longer applies. If statutory retention periods prevent deletion, these remain unaffected. The legal basis for obtaining consent is Section 25(1) of the TDDDG. You may revoke your consent at any time with future effect. If you wish to change your settings, please contact us or follow the instructions on our website. You may exercise any right to revoke consent by sending us an informal notice via email. You may also contact our Data Protection Officer, who will forward your request to us. However, the lawfulness of the data processing carried out up until the revocation remains unaffected by your revocation. To demonstrate compliance with data protection regulations and to outline our respective obligations, we have entered into a data processing agreement. This is a contract required under data protection law pursuant to Art. 28(3) of the GDPR, which ensures that our data processor processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR. The provider of the cookie banner is: Complianz B.V. Kalmarweg 14-5, 9723 JG Groningen

Use of a consent management tool

We use the consent management tool “Complianz” on our website. The provider is Complianz B.V., Kalmarweg 14-5, 9723 JG Groningen, Netherlands. Complianz enables us to obtain, manage, and document the consent of our website visitors for services subject to data protection requirements. To this end, your cookie settings are stored and retrieved each time you visit our website. The data processed includes your IP address (anonymized), the time of consent, and the settings you have selected. Since the provider is based in the Netherlands, no data is transferred to a third country. The legal basis for data processing is our legitimate interest pursuant to Article 6(1)(f) of the GDPR, as we are legally required to document consent in a verifiable manner. For more information, please see Complianz’s Privacy Policy: https://complianz.io/privacy-statement/

Special offers on our website

We offer services on our website that are specially tailored to our industry. These are the following services:

Online bookings, booking inquiries and reservations

For online bookings, booking inquiries, and reservations, we use two separate methods. The Inquiry Module We operate our website ourselves; the information you provide there is sent directly to us and is processed by us. The Online Booking Process (Internet Booking Engine) is provided by an external service provider and is listed separately further down in this section. If you would like to make an online booking, submit a booking request, or make a reservation on our website, we will need your information. To process your request, we need your email address, your travel dates, the product you’ve booked, your first and last name, and, if you wish, your title. In certain cases, we may also ask for your phone number so that we can contact you in the event of unforeseen circumstances requiring short-notice notification, provided these circumstances could affect your booking. To calculate your travel price, we need your travel dates, the selected product, the number of travelers, and whether the travelers are children or adults. If you are traveling with children, we will also ask for their specific ages to calculate the price. To complete the booking, we need the payment method you wish to use for the trip. If you wish to make an advance payment, we will redirect you to your preferred payment service provider to process the payment. Additional information provided in the booking form is voluntary and is not required for us to process the online booking, booking inquiry, or reservation. The legal basis for data processing in connection with an online booking, booking inquiry, or reservation is Article 6(1)(b) of the GDPR for the performance of a contract or the implementation of pre-contractual measures. The data collected during the inquiry is stored in a system. If you provide specific personal data relevant to the fulfillment of our services—such as allergy-related intolerances—this data will also be stored. The data transmitted to us will remain with us until the purpose for storing the data no longer applies, such as after your request has been fully processed. However, mandatory statutory retention periods may prevent the deletion of your data. To demonstrate compliance with data protection regulations and to outline our respective obligations, we have entered into a data processing agreement. This is a contract required under data protection law pursuant to Article 28(3) of the GDPR, which ensures that our data processor processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR. The online booking system (“DIRS21”) is provided by TourOnline AG, Borsigstraße 26, 73249 Wernau, registered in the Commercial Register of the Stuttgart Local Court under HRB 214796. When you access the booking process, content is loaded from TourOnline AG’s servers. Your IP address is transmitted to the provider in the process; without this transmission, the booking process could not be displayed for technical reasons. The provider uses cookies that are necessary for the booking process. The data you enter during the booking process is processed to complete the booking and transmitted to us. For more information on data protection at DIRS21, please visit https://www.dirs21.de.

Possibility to register on our website

You have the option to register on our website. You can use this registration to unlock additional features on our site. We use the data you enter in the registration form solely for the purposes for which you registered. We can only complete the registration if all information required for registration is provided. Otherwise, we will unfortunately have to reject the registration. In the event of any necessary changes, we will use the email address you provided to contact you. We process the data you provide based on your consent pursuant to Article 6(1)(a) of the GDPR. You may revoke your consent at any time with future effect. You may revoke your consent by sending us an informal notice via email. You may also contact our Data Protection Officer, who will forward your request to us. However, the lawfulness of the data processing carried out up until the time of revocation remains unaffected by your revocation. We will store your data for as long as you remain registered on our website. Your data will be deleted thereafter, provided that this does not conflict with any statutory retention periods.

Sign up for our newsletter

You can voluntarily subscribe to our newsletter. In doing so, we process the data you provided in the registration form, as well as your email address, in order to process your registration and in case we have any follow-up questions for you. However, we will not disclose your data to third parties without your consent. The legal basis for processing your data is your consent pursuant to Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG. You may revoke your consent at any time with future effect. To do so, simply send us an informal email. However, this does not affect the lawfulness of our data processing prior to the revocation. The data you provide will remain with us until you request that we delete it or revoke your consent to its storage. Mandatory legal provisions, such as statutory retention periods, remain unaffected by this.

Inquiries via contact form

You can use our contact form at any time to send us inquiries. We process the data you provided in the contact form, as well as your email address, in order to handle your inquiry and in case we have any follow-up questions for you. However, we do not share your data with third parties without your consent. The legal basis for processing your data is Article 6(1)(b) of the GDPR, provided that your inquiry relates to the performance of a contract or is necessary for the implementation of pre-contractual measures. In other cases, the processing is based on our legitimate interest in effectively handling your inquiry pursuant to Article 6(1)(f) of the GDPR or on your consent pursuant to Article 6(1)(a) of the GDPR, if we have requested it. You may revoke your consent at any time with future effect. To do so, simply send us an informal email. However, this does not affect the lawfulness of our data processing until such time as consent is revoked. The data you provide will remain with us until you request that we delete it or revoke your consent to its storage. Mandatory legal provisions, such as statutory retention periods, remain unaffected.

Inquiries by e-mail, telephone and fax

You can contact us at any time by email, phone, or fax. We process the data you have provided to us in order to handle your inquiry. However, we do not disclose your data to third parties without your consent. The legal basis for processing your data is Article 6(1)(b) of the GDPR, provided your inquiry is related to the performance of a contract or is necessary for the implementation of precontractual measures, or it is based on your consent pursuant to Article 6(1)(a) of the GDPR, if we have requested such consent. You may revoke your consent at any time with future effect. To do so, simply send us an informal email. However, this does not affect the lawfulness of our data processing prior to the revocation. The data you provide will remain with us until you request its deletion or revoke your consent to its storage. Mandatory legal provisions, such as statutory retention periods, remain unaffected. In other cases, processing is based on our legitimate interest in effectively handling your inquiry pursuant to Article 6(1)(f) of the GDPR.

Dispatch of postal advertising

We use your address to send you direct mail. The legal basis for processing your data is our legitimate interest in direct marketing pursuant to Article 6(1)(f) of the GDPR in conjunction with Recital 47 of the GDPR. In the event that we have requested your consent, data processing is based solely on Article 6(1)(a) of the GDPR. You may revoke your consent at any time with future effect. To do so, simply send us an informal notice via email. However, this does not affect the lawfulness of our data processing prior to the revocation. The data you provide will remain with us until you request that we delete it or revoke your consent to its storage. Mandatory legal provisions, such as statutory retention periods, remain unaffected.

Use of an AI-powered chat assistant

Our website features an AI-powered chat assistant (“Gamsi”). It is powered by the Claude API from Anthropic, PBC, 548 Market St., PMB 90375, San Francisco, CA 94104, USA. When you use the chat assistant and enter messages, your input is transmitted to Anthropic’s servers for processing. In doing so, your IP address and the content you enter may be processed. Anthropic acts as our data processor in accordance with Article 28 of the GDPR. The data is transferred to the United States. This transfer to a third country is safeguarded by Standard Contractual Clauses (SCCs) in accordance with Article 46 of the GDPR.

Logging of requests

Your questions submitted via the chat assistant, as well as Gamsi’s responses, are recorded in a log and stored on our web server (hosted by STRATO AG, Pascalstraße 10, 10587 Berlin). This data is stored in a pseudonymized form: We store a randomly generated session ID, but neither your IP address nor your name. Please note that any information you voluntarily enter into the chat is logged verbatim. We therefore ask that you refrain from providing any information in the chat that you do not wish to have stored, and in particular, that you do not transmit any special categories of personal data as defined in Article 9 of the GDPR (such as health data). Access to these logs is restricted exclusively to the hotel operator for internal analysis and to improve our services. The logs are deleted after twelve months at the latest. The legal basis for logging inquiries is Article 6(1)(b) of the GDPR (pre-contractual measures) as well as our legitimate interest in improving our services pursuant to Article 6(1)(f) of the GDPR. The legal basis for processing via the Claude API is your consent pursuant to Article 6(1)(a) of the GDPR, which you provide via our cookie consent tool. You may withdraw your consent at any time with future effect. For more information on data protection at Anthropic, please visit: https://www.anthropic.com/privacy

Inquiries via the forms in the chat

For certain matters, Gamsi displays a form that allows you to send your inquiry directly to us. This applies to reservation requests, inquiries about wellness and massage services, requests to our front desk (such as room decorations, traveling with a dog, or group bookings), and requests for a quote via email. We process the data you provide—typically your name and email address, and optionally your phone number—as well as a summary of your inquiry generated by Gamsi based on the conversation history to date. This information is forwarded via email to the relevant department at our hotel (reception, reservations, wellness, restaurant, or administration) and used there to process your inquiry. The data is not disclosed to third parties for advertising purposes. Along with your inquiry, we store the time of submission, your confirmation of this privacy notice, and your IP address. The IP address is used exclusively to verify your consent and to prevent misuse of the form; it is deleted after twelve months at the latest. The legal basis is Article 6(1)(b) of the GDPR (processing your inquiry and initiating a potential contract) as well as—with regard to the storage of the IP address—our legitimate interest pursuant to Article 6(1)(f) of the GDPR in verifying consent and ensuring the security of our systems.

Gamsi via WhatsApp (WhatsApp Business Platform and Chatwoot)

We also offer our chat assistant “Gamsi” via WhatsApp. When you contact us via WhatsApp, we process the messages you send, your cell phone number, and your WhatsApp profile name to respond to your inquiry, initiate a potential booking, and connect you with our front desk. Using WhatsApp is optional; you can, of course, also reach us by phone (+49 8324 9840) or by email (info@die-gams.de). WhatsApp Business Platform / Meta. Messages are sent and received via the WhatsApp Business Platform (Cloud API), provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbor, Dublin 2, Ireland. When sending and receiving messages, your messages and the aforementioned inventory data are processed via Meta’s infrastructure. This may involve the transfer of data to third countries (including the United States). This is safeguarded by appropriate safeguards (EU Standard Contractual Clauses pursuant to Art. 46 of the GDPR and/or the EU-U.S. Data Privacy Framework). Please note that WhatsApp is a service provided by Meta, and your use of the service is also subject to the privacy policies of WhatsApp and Meta. For more information: https://www.whatsapp.com/legal/business-policy/ Message management via Chatwoot. We use the “Chatwoot” software, provided by Chatwoot Inc. in San Francisco, California, USA, to manage, display, and respond to incoming WhatsApp messages. Chatwoot stores your messages, your cell phone number, your WhatsApp profile name, and the conversation history so that our reception desk can reply to you and, if necessary, take over the conversation personally. Chatwoot processes this data exclusively in accordance with our instructions as a data processor pursuant to Art. 28 of the GDPR; a corresponding data processing agreement is in place. Hosting takes place on servers in the United States; the associated transfer to a third country is safeguarded by EU Standard Contractual Clauses in accordance with Article 46 of the GDPR. Your conversation data is stored for the duration of your use of the service (up to twelve months) and then deleted; we will delete it earlier upon your request. Further information: https://www.chatwoot.com/privacy-policy AI-powered answers. Gamsi’s automated replies on WhatsApp—as well as those on our website—are generated using Anthropic, PBC’s Claude API. To do this, the content of your messages is transmitted to Anthropic to generate the reply and is processed there. In accordance with its own contractual commitments, Anthropic does not use content transmitted via the API to train its models. The transfer of data to the United States is safeguarded by standard contractual clauses in accordance with Article 46 of the GDPR. Hand over to the front desk. If you request to speak with a staff member or request a callback via chat, your message—including any information you voluntarily provide, such as your name and preferred time—will be forwarded to our front desk, which will respond to you personally. Legal basis. The legal basis for processing the data you submit via WhatsApp is Article 6(1)(b) of the GDPR (processing your inquiry and initiating a potential contract) as well as our legitimate interest in efficient and service-oriented guest communication pursuant to Article 6(1)(f) of the GDPR. By voluntarily contacting us via WhatsApp, you initiate this processing. On WhatsApp, the processing does not take place on the basis of consent granted via our cookie consent tool, as this tool is not technically used there. Note. Gamsi is an AI-powered assistant and may make mistakes; for official information—such as availability and prices—please contact our front desk. Please do not send particularly sensitive data, such as health information, via WhatsApp; please use the phone, email, or contact us in person for this purpose. You can exercise your data subject rights with us and—with regard to processing by Meta—directly with Meta as well.

Regional Information in the Chat Assistant

To ensure that Gamsi can provide you with up-to-date information, our server retrieves data from third parties in the background, including weather data as well as event and occupancy data from BayernCloud Tourismus. These requests are made exclusively by our server and are independent of your visit; no data about you is transmitted to these providers in the process.

Data processing by social networks

We use a publicly accessible profile on various social networks. Social networks may analyze your behavior even when you visit our website, since we have integrated social network plug-ins or other links. Personal data is collected even if you are not logged in as a user or do not have an account with the respective provider. Your data is collected via cookies stored on your device or by recording your IP address. Social media platforms create user profiles. They use these profiles to store your interests and preferences so that you are shown interest-based advertising. If you have a profile with the respective provider, the ads will be displayed on all devices on which you are or have been logged in. The data you provide remains with us until you request that we delete it or revoke your consent to its storage. Mandatory legal provisions, such as statutory retention periods, remain unaffected by this. Stored cookies, unless they are session cookies, remain on your device until you delete them. To demonstrate compliance with data protection regulations and to outline our respective obligations, we have entered into a data processing agreement with the respective provider. This is a contract required under data protection law pursuant to Art. 28(3) of the GDPR, which ensures that our data processor processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

Meta Plug-In and Meta Profile

We maintain a profile on Meta (formerly Facebook). The provider is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (hereinafter: “Meta”). In addition, we have integrated a Meta plug-in into our website. You can recognize these by the Meta profile button or the “Like” button. An overview of the Facebook/Meta plug-ins can be found at: https://developers.facebook.com/docs/plugins/?locale=de_DE. The mere integration of the plug-in does not result in any direct data transfer to Meta. Processing of personal data only occurs when you access information beyond the homepage of a Meta profile; as the operator, we are no longer responsible for this processing, since you have voluntarily placed yourself under Meta’s data sovereignty by giving your consent via the “two-click solution.” The legal basis for our data processing is our legitimate interest in achieving the widest possible visibility on social media pursuant to Art. 6(1)(f) of the GDPR. If consent was requested, Meta’s data processing is based on your consent pursuant to Art. 6(1)(a) of the GDPR. You may revoke your consent at any time with future effect. You may exercise this right by sending us an informal notice via email. You may also contact our Data Protection Officer, who will forward your request to us. However, the lawfulness of the data processing carried out up to the time of revocation remains unaffected by your revocation. The use of a Meta profile does not give rise to joint controllership under Article 26 of the GDPR with respect to any processing of personal data. Through the “two-click solution” we have implemented, you voluntarily choose to place yourself under Meta’s data sovereignty. Consequently, contrary to the CJEU ruling of June 5, 2018, Case C-210/16, there is no joint responsibility based on a joint decision regarding the purposes and means of data processing, since Meta does not process personal data until you have already voluntarily placed yourself under Meta’s data control. The processing of personal data that occurs after it is transferred to Meta is not attributable to us. Furthermore, in the highly unlikely event of joint controllership, the required agreement under Article 26(3) of the GDPR is provided by the addendum made available by Meta: https://www.facebook.com/legal/controller_addendum. Under this agreement, we are obligated to make the privacy notice available in accordance with Article 13 et seq. of the GDPR and to integrate the Meta tool into our website in a manner that complies with data protection regulations. You may exercise your data subject rights directly with Meta. In the event that you exercise your data subject rights with us regarding the use of Meta, we are obligated to forward your request to Meta. The data processed by Meta is also transferred to the United States and other third countries. The data transfer to the United States is again based on an adequacy decision by the European Commission. Meta is a certified partner under the EU-U.S. Privacy Framework. Details can be found at: https://facebook.com/legal/EU_data_transfer_addendum, https://de-de.facebook.com/help/566994660333381, and https://facebook.com/policy.php. Further information can be found in the Terms of Use and the Privacy Policy. These are available at: https://de-de.facebook.com/about/privacy/ and https://de-de.facebook.com/legal/terms/.

Instagram plug-in and Instagram profile

We maintain a profile on Instagram. The provider is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (hereinafter: “Meta”). In addition, we have integrated an Instagram plug-in into our website. You can recognize this by the Instagram profile button. The mere integration of the plug-in does not result in any direct data transfer to Meta. Processing of personal data only occurs when you access information beyond the home page of an Instagram profile; this processing is no longer attributable to us as the operator, since you have voluntarily placed yourself under Meta’s data sovereignty by giving your consent via the “two-click solution.” The legal basis for our data processing is our legitimate interest in achieving the widest possible visibility on social media pursuant to Article 6(1)(f) of the GDPR. If consent has been requested, Meta’s data processing is based on your consent pursuant to Article 6(1)(a) of the GDPR. You may revoke your consent at any time with future effect. You may exercise this right by sending us an informal notice via email. You may also contact our Data Protection Officer, who will forward your request to us. However, the lawfulness of data processing carried out prior to the revocation remains unaffected by your revocation. The use of an Instagram profile does not give rise to joint controllership under Article 26 of the GDPR with respect to any processing of personal data. Through the “two-click solution” we have implemented, you voluntarily choose to place yourself under Meta’s data sovereignty. Consequently, contrary to the ECJ ruling of June 5, 2018, C-210/16, there is no joint responsibility based on a joint decision regarding the purposes and means of data processing, as Meta only processes personal data once you have voluntarily placed yourself under Meta’s data control. The processing of personal data that occurs after the data is transferred to Meta is not attributable to us. Furthermore, in the highly unlikely event of joint controllership, the required agreement under Article 26(3) of the GDPR is set forth in the addendum provided by Meta: https://www.facebook.com/legal/controller_addendum. Under this agreement, we are obligated to make the privacy notice available in accordance with Article 13 et seq. of the GDPR and to integrate the Meta tool into our website in a manner that complies with data protection regulations. You may exercise your data subject rights directly with Meta. In the event that you exercise your data subject rights with us regarding the use of Instagram, we are obligated to forward your request to Meta. The data processed by Meta is also transferred to the U.S. and other third countries. Data transfers to the U.S. are again based on an adequacy decision by the European Commission. Meta is a certified partner under the EU-U.S. Privacy Framework. For details, see: https://facebook.com/legal/EU_data_transfer_addendum, https://de-de.facebook.com/help/566994660333381, and https://facebook.com/policy.php. For more information, please refer to the Terms of Use and the Privacy Policy. These can be found at: https://de-de.facebook.com/about/privacy/ and https://de-de.facebook.com/legal/terms/.

Integration of analysis tools and plug-ins

We use various analytics and advertising tools. To demonstrate that data processing complies with data protection regulations and to outline our respective obligations, we have entered into a data processing agreement with each provider. This is a contract required under data protection law pursuant to Article 28(3) of the GDPR, which ensures that our data processor processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

Integration of Google Tag Manager

We use Google Tag Manager to integrate tracking and analytics tools into our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: “Google Tag Manager”). This technology does not create user profiles, does not store cookies, and does not perform any analyses itself; it merely stores your IP address. Google Tag Manager manages the integrated tools. The data processed by Google is also transferred to the United States and other third countries. Data transfers to the United States are again based on an adequacy decision by the European Commission. Google is a certified partner under the EU-U.S. Privacy Framework. For details, see: https://privacy.google.com/businesses/controllerterms/mccs/

Integration of YouTube

We use YouTube videos for visual presentation. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: “Google”). YouTube transmits data to its partners and, due to its integration on our website, establishes a connection to Google regardless of whether a video is viewed or not. However, if you watch a video, YouTube connects to YouTube’s servers, which are informed of the page you are visiting. If you are logged into your account, YouTube will perform profiling. To prevent this, you must log out of your account. After a video is started, various cookies are stored on your device to gather information about visitors to our website. We have no control over the data processing carried out by YouTube. The legal basis for the data processing is our legitimate interest in presenting our online offering in an appealing and consistent manner pursuant to Article 6(1)(f) of the GDPR. If consent has been requested, data processing is based on your consent pursuant to Article 6(1)(a) of the GDPR. You may revoke your consent at any time with future effect. You may exercise this right by sending us an informal notice via email. You may also contact our Data Protection Officer, who will forward your request to us. However, the lawfulness of the data processing carried out prior to revocation remains unaffected by your revocation. The data processed by YouTube is also transferred to the United States and other third countries. The data transfer to the United States is again based on an adequacy decision by the European Commission. Google is a certified partner under the EU-U.S. Privacy Framework. For details, visit: https://privacy.google.com/businesses/controllerterms/mccs/. For further information, please see the following link: https://policies.google.com/privacy?hl=de.

Integration of Google Fonts

We use web fonts provided by Google for the uniform display of fonts. The fonts are installed locally, which is why no connection to Google's servers is established.

Integration of Google Maps

We use Google Maps to display our location. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: “Google”). Google Maps stores your IP address, which is transmitted to Google’s servers. We have no influence over Google’s data processing. Google may also incorporate Google Web Fonts when you use Google Maps. The legal basis for data processing is our legitimate interest in presenting our online offering in an appealing manner in accordance with Article 6(1)(f) of the GDPR. If consent has been requested, Google’s data processing is based on your consent pursuant to Article 6(1)(a) of the GDPR. You may revoke your consent at any time with future effect. You may revoke your consent by sending us an informal email. You may also contact our Data Protection Officer, who will forward your request to us. However, the lawfulness of the data processing carried out prior to the revocation remains unaffected by your revocation. The data processed by Google is also transferred to the United States and other third countries. Data transfers to the United States are again based on an adequacy decision by the European Commission. Google is a certified partner under the EU-U.S. Privacy Framework. For details, please visit: https://privacy.google.com/businesses/controllerterms/mccs/

Integration of Google reCAPTCHA

We use the website analytics service Google reCAPTCHA. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: “Google”). Google reCAPTCHA is used to verify whether data entered into forms is being entered by a human or by an automated process. Google analyzes the behavior of website visitors as soon as you access our website. For these analyses, Google evaluates information such as the IP address, the duration of your visit to the website, and mouse movements. The collected data is transmitted to Google. We have no influence over Google’s data processing. The legal basis for data processing is our legitimate interest in analyzing our website to protect against spam or data scraping, in accordance with Article 6(1)(f) of the GDPR. If consent has been requested, Google’s data processing is based on your consent pursuant to Article 6(1)(a) of the GDPR. You may revoke your consent at any time with future effect. You may exercise your right to withdraw consent by sending us an informal notice via email. You may also contact our Data Protection Officer, who will forward your request to us. However, the lawfulness of the data processing carried out prior to the withdrawal remains unaffected by your withdrawal. The data processed by Google is also transferred to the United States and other third countries. Data transfers to the United States are again based on an adequacy decision by the European Commission. Google is a certified partner under the EU-U.S. Privacy Framework. For details, see: https://privacy.google.com/businesses/controllerterms/mccs/

Functional plugins

Integration of Weglot

Our website uses the “Weglot” plugin from Weglot SAS, 138 Rue Pierre Joigneaux, 92270 Bois-Colombes, France, to provide content in multiple languages. This processing is carried out to improve user-friendliness and ensure accessible communication based on our legitimate interest pursuant to Art. 6(1)(f) of the GDPR. When you use the language selector, your IP address is transmitted to Weglot to correctly display and save your language preference. In doing so, Weglot may use cookies to remember your selected language setting. No further profiling or analysis of user behavior takes place. Data is generally transferred within the EU; according to the provider, no transfer to third countries is planned. For more information, please see Weglot’s privacy policy.

Integration of Elementor

On our website, we use the Elementor plugin, a website builder developed by Elementor Ltd., Tuval 40, Ramat Gan, 5252247, Israel, for the visual design and presentation of content. The plugin is integrated locally into our WordPress installation and does not process any personal data itself, provided that no additional features such as external add-ons are used. Elementor does not set cookies for tracking or marketing purposes. However, if third-party content such as Google Maps, YouTube, or social media feeds is integrated via corresponding widgets, personal data—such as your IP address—may be transmitted to the respective providers. Such content is loaded only if it is configured accordingly and, where applicable, with your consent. The processing serves to ensure an appealing and technically functional presentation of our website and is based on our legitimate interest pursuant to Art. 6(1)(f) of the GDPR. Elementor itself does not store any personal data.

Payment transactions on our website

We have integrated an online store on our website and therefore use online payments.

General information

In this context, we process your personal data only if it is necessary for the performance of a contract or in connection with pre-contractual measures, in accordance with Article 6(1)(b) of the GDPR. We process your usage data when it is necessary to provide you with our online service in connection with an online payment. Your data will be deleted upon termination of the business relationship or upon completion of the order, provided that no statutory retention periods preclude such deletion. When you order goods or request services, your personal data will be shared with our shipping carrier, any other partners, and the payment service provider we use. The sharing of data is limited to the data that is strictly necessary to fulfill the respective task. The legal basis for data processing is Article 6(1)(b) of the GDPR. If you have provided consent pursuant to Article 6(1)(a) of the GDPR, your email address will be shared with our shipping carrier so that you can track the shipping status of your order. You may revoke your consent at any time with future effect. You may revoke your consent by sending us an informal notice via email. You may also contact our Data Protection Officer, who will forward your request to us. However, the lawfulness of the data processing carried out up to the time of revocation remains unaffected by your revocation.

Payment service provider

We use various payment service providers to process our contracts. We provide the payment service provider with certain personal data necessary for it to perform its tasks, namely your name, payment amount, bank account information, and credit card information. The legal basis for data processing is Article 6(1)(b) of the GDPR, as well as Furthermore, the legal basis is our legitimate interest in smooth, convenient, and secure payment processing pursuant to Article 6(1)(f) of the GDPR. If consent has been requested, data processing is based on your consent pursuant to Article 6(1)(a) of the GDPR. You may revoke your consent at any time with future effect. You may exercise this right by sending us an informal notice via email. You may also contact our Data Protection Officer, who will forward your request to us. However, the lawfulness of the data processing carried out prior to the revocation remains unaffected by your revocation. If the respective provider also transfers the processed data to the U.S. and other third countries, this data transfer to the U.S. is based on an adequacy decision by the European Commission. The decisive factor is whether the respective partner is certified under the EU-U.S. Privacy Framework. Details can be found in the information about the respective provider. To demonstrate compliance with data protection regulations and to outline our respective obligations, we have entered into a data processing agreement with the respective provider. This is a contract required under data protection law pursuant to Article 28(3) of the GDPR, which ensures that our data processor processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

Maestro

We offer a simple payment option via Mastercard debit card. The provider is Mastercard Europe SA, Chaussée de Tervuren 198A, B-1410 Waterloo, Belgium (hereinafter: “Mastercard”). Data transmission: https://www.mastercard.us/content/dam/mccom/global/documents/mastercard-bcrs.pdf – Details on the privacy policy: https://www.mastercard.de/de-de/datenschutz.html.

Paypal

We offer uncomplicated payment via PayPal. The provider is PayPal (Europe) S.a.r.l. et Cie. S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter: "PayPal"). Data transfer: https://www.paypal.com/de/webapps/mpp/ua/pocpsa-full - Details of the privacy policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

Giropay

We offer uncomplicated payment via giropay. The provider is paydirekt GmbH, Stephanstr. 14-16 in 60313 Frankfurt am Main ("giropay").

Mastercard

We offer a simple payment option using your Mastercard credit card. The provider is Mastercard Europe SA, Chaussée de Tervuren 198A, B-1410 Waterloo, Belgium (hereinafter: “Mastercard”). Data transmission: https://www.mastercard.us/content/dam/mccom/global/documents/mastercard-bcrs.pdf – Details on the privacy policy: https://www.mastercard.de/de-de/datenschutz.html.

VISA

We offer uncomplicated payment via your VISA credit card. The provider is Visa Europe Service Inc, London Branch, 1 Sheldon Square, London W2 6TT, United Kingdom (hereinafter: "VISA"). Data transfer: https://www.visa.de/nutzungsbedingungen/visa-globale-datenschutzmitteilung/mitteilung-zuzustandigkeitsfragen-fur-den-ewr.html - Details of the privacy policy: https://www.visa.de/nutzungsbedingungen/visa-privacy-center.html.

Our own services - Dealing with applicants

You may apply to us at any time, either on your own initiative or in response to a job posting. We accept applications via email, by mail, and through our online application form. Below, we would like to inform you about how we process your data as part of the application process. We process your personal data—such as contact and communication information, application documents, and notes taken during job interviews—to the extent necessary for establishing an employment relationship. If we offer you a position, your data will continue to be processed for the purposes of carrying out your employment relationship. If we are unable to offer you a position, if you decline our offer, or if you withdraw your application, we reserve the right to retain your documents for up to six months after the application process has ended. After this period expires, your data will be deleted and destroyed. Mandatory statutory retention periods remain unaffected by this. If you have given us your consent to longer retention, your data may be retained for a longer period. The legal basis for our data processing is Art. 6(1)(b) of the GDPR in conjunction with § 26 of the BDSG. If you have provided consent pursuant to Art. 6(1)(a) of the GDPR, data processing is based on your consent. You may revoke your consent at any time with future effect. You may exercise this right by sending us an informal notice via email. You may also contact our Data Protection Officer, who will forward your request to us. However, the lawfulness of the data processing carried out up until the revocation remains unaffected by your revocation. You have the option to be added to our applicant pool. This includes all documents and information from your application so that we can contact you when suitable vacancies arise. The legal basis for this data processing is your explicit consent pursuant to Article 6(1)(a) of the GDPR. You may revoke your consent at any time with future effect. You may exercise your right to withdraw consent by sending us an informal notice via email. You may also contact our Data Protection Officer, who will forward your request to us. However, the lawfulness of the data processing carried out up to the point of withdrawal remains unaffected by your withdrawal of consent. Digital Reporting Portal for Whistleblowers HinSchG