Privacy Policy, dated July 2023
Partnachklamm
Address: Partnach Gorge, 82467 Garmisch-Partenkirchen,
VAT Number: DE128378289
Email: partnachklamm-webshop@gapa.de
PRIVACY POLICY
1. Data Proccessor
Markt Garmisch-Partenkirchen
Rathausplatz 1
08821/910-0
82467 Garmisch-Partenkirchen
E-Mail: rathaus@gapa.de
Contact information for the Data Protection Officer:
Markt Garmisch-Partenkirchen
-persönlich-
Rathausplatz 1
82467 Garmisch-Partenkirchen
E-Mail: dsb@gapa.de
2. Scope of Processing and Source of Data
2.1. Purpose and Legal Basis for Processing
Art. 6, Paragraph 1, Subparagraph b of the GDPR
Customer Data: The collection, processing, or use of personal data is carried out to fulfill the business purpose of providing quotes, order confirmations, and invoices; to order goods and services; to maintain business contact; and to receive information from the customer (Art. 6, Paragraph 1, Subparagraph b of the GDPR). Furthermore, there is a legal obligation to process such data, e.g., due to tax law requirements (Art. 6(1)(c) of the EU GDPR).
2.2. Categories of personal data processed:
The main categories of data are:
Name
Address
Contact information for company representatives (first name, last name)
Communication data (phone number, cell phone number, email address)
2.3. Origin (Source) of the Data
The stored data was collected in connection with our contractual relationship, for the purpose of entering into a contract, and in connection with individual orders; alternatively, it was generated in the course of business relationships and business development. The data is stored to fulfill and process the orders placed with us, as well as to comply with documentation and archiving obligations under commercial and tax law.
2.4. Recipients (Categories) of Personal Data
Public authorities that receive data pursuant to legal requirements:
Tax authorities
Internal departments involved in the execution of the respective business processes:
Management, Accounting, Functional Departments (Communications or Destination Development & Infrastructure or Guests & Partner Management or QM&IT)
External entities (contractual partners) to the extent necessary for the fulfillment of the contract. External contractors (service providers) in accordance with Art. 28 of the GDPR to process the data on our behalf:
IT service providers, software providers
Other external entities: group companies or other external entities for the fulfillment of the purposes mentioned above
3. Transfer to Third Countries
Personal data is not transferred outside the European Union.
4. Retention Period / Deletion
Once the purpose has been fulfilled and the statutory retention periods have been observed, the data will be
deleted.
6 years: Commercial and business correspondence, as well as other documents (German Commercial Code (HGB), German Civil Code (BGB))
10 years: Annual financial statements, opening balance sheets, commercial and business records, records, work instructions, organizational documents, invoices, and accounting vouchers (German Commercial Code (HGB), German Fiscal Code (AO), German Income Tax Act (EStG), German Corporate Income Tax Act (KStG), German Trade Tax Act (GewStG), German Value-Added Tax Act (UStG), German Stock Corporation Act (AktG), German Limited Liability Company Act (GmbHG), German Cooperative Act (GenG))
30 years: Enforceable titles
5. Rights of the Data Subject
Access to the personal data stored about you (Art. 15 GDPR). In particular, you may request information regarding the purposes of processing, the categories of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned retention period, the existence of a right to rectification, erasure, restriction of processing, or objection, the
existence of a right to lodge a complaint, the origin of your data if it was not collected by us, as well as information regarding the existence of automated decision-making, including profiling, and, where applicable, meaningful information regarding its details.
Rectification—If inaccurate personal data is being processed (Art. 16 GDPR),
Right to File a Complaint with the Competent Supervisory Authority (Art. 77 GDPR)
6. Automated Decision-Making and Profiling
No automated decision-making processes pursuant to Art. 22 GDPR or other profiling measures pursuant to Art. 4(4) GDPR are used.
7. Validity and Changes to This Privacy Notice Pursuant to Articles 13 and 14 of the GDPR
Due to changes in legal or regulatory requirements, among other reasons, it may become necessary to amend this privacy notice. You may access and print the most current privacy notice at any time on the website https://www.gapa-tourismus.de/datenschutz-gaeste.
This privacy notice is currently valid and is effective as of July 31, 2023.
Partnachklamm
Address: Partnach Gorge, 82467 Garmisch-Partenkirchen,
VAT Number: DE128378289
Email: partnachklamm-webshop@gapa.de
PRIVACY POLICY – Extended Version
Privacy Policy for Guests
MARKT GARMISCH-PARTENKIRCHEN
Information Requirements Under Articles 13 and 14 of the GDPR for Customers
We are pleased that we have sparked your interest in our region and our offerings. We are deeply committed to protecting your privacy and your personal data. The collection and use of your data therefore always take place in accordance with the provisions of the General Data Protection Regulation (EU) 2016/679 (GDPR), the Federal Data Protection Act (BDSG), the Act on Data Protection and the Protection of Privacy in Telecommunications and Digital Services (TDDDG), and the Digital Services Act (DDG). As the data controller, we therefore provide the following information regarding what data we collect and how we process it.
1. Data Controller
The data controller for this website within the meaning of the General Data Protection Regulation and other national data protection laws of the member states, as well as other data protection regulations, is:
1.Bürgermeister
Markt Garmisch-Partenkirchen
Rathausplatz 1
82467 Garmisch-Partenkirchen
08821/910-0
E-Mail-Adresse: partnachklamm-webshop@gapa.de
UID-Nr.: : DE128378289
Kontaktdaten der Datenschutzbeauftragten:
Mail: datenschutz@gapa.de
2. Personal Data
Personal data, as defined in Article 4(1) of the GDPR, means any information relating to an identified or identifiable natural person; A natural person is considered identifiable if they can be identified, directly or indirectly, in particular by association with an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person. Personal data is stored only to the extent necessary to provide the booked service, to comply with legal requirements, or for the purpose specified below.
3. Purpose of Collecting Personal Data
However, the collection of personal data becomes essential when you book an event or other service through our portal, contact us, or wish to use other offerings on our site for which personal data is essential to process the request.
In accordance with legal regulations and in the spirit of data minimization, we generally collect only the data necessary to provide that specific service. If we ask for additional information in our forms, providing it is always voluntary and marked as such.
The temporary storage of the IP address by the system is necessary to enable the website to be delivered to the user’s computer. For this purpose, the user’s IP address must be stored for the duration of the session. Data is also stored in log files to ensure the website functions properly. In addition, we use this data to optimize the website and to ensure the security of our IT systems. The data is not analyzed for marketing purposes in this context. These purposes also constitute our legitimate interest in data processing pursuant to Article 6(1)(f) of the GDPR.
When you book a service, the data collected in connection with the booking will be used to process the booking, for promotional purposes within the limits of the law, and for statistical purposes.
If you submit inquiries to us via the contact form, we will store the information you provide in the inquiry form—including the contact information you provide there—for the purpose of processing your inquiry and in case of follow-up questions. We will not disclose this data without your consent.
The processing of this data is based on Article 6(1)(b) of the GDPR, provided that your inquiry is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, processing is based on our legitimate interest in the effective handling of inquiries directed to us (Article 6(1)(f) of the GDPR) or on your consent (Article 6(1)(a) of the GDPR), provided that consent was requested; you may revoke your consent at any time.
To do so, simply send an informal email to partnachklamm@gapa.de. The lawfulness of data processing operations carried out prior to revocation remains unaffected by the revocation.
The data you enter in the contact form will remain with us until you request that we delete it, revoke your consent to its storage, or the purpose for storing the data no longer applies (e.g., after your inquiry has been processed). Mandatory legal provisions—in particular retention periods—remain unaffected.
We also use the personal data we store to maintain customer relationships, provide customer service (e.g., information regarding the details of your stay), carry out our own advertising and marketing activities (e.g., sending catalogs or other promotional mailings within the limits permitted by law, and conducting customer satisfaction surveys), and process orders.
For suppliers and service providers of the data controller, the processing or use of personal data takes place within the framework of the supplier relationship to fulfill the business purpose of ordering offers, order confirmations, invoices, goods, and services, as well as to maintain business contact and receive information from the supplier (Art. 6(1)(a), (b), (f) GDPR).
4. Legal Basis for the Processing of Personal Data
To the extent that we obtain the data subject’s consent for the processing of personal data, Article 6(1)(a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis. The lawfulness of the processing is established by your consent.
You may withdraw your consent at any time. Please note that the withdrawal takes effect for the future and does not affect processing that took place prior to the withdrawal.
When processing personal data necessary for the performance of a contract to which the data subject is a party, Article 6(1)(b) of the GDPR serves as the legal basis. This also applies to processing operations necessary for the implementation of pre-contractual measures.
To the extent that the processing of personal data is necessary to comply with a legal obligation to which our company is subject, Article 6(1)(c) of the GDPR serves as the legal basis.
In cases where the vital interests of the data subject or another natural person require the processing of personal data, Article 6(1)(d) of the GDPR serves as the legal basis.
If processing is necessary to safeguard a legitimate interest of our company or a third party, and the interests, fundamental rights, and fundamental freedoms of the data subject do not override the aforementioned interest, Article 6(1)(f) of the GDPR serves as the legal basis for the processing.
This applies in particular to the following categories of cases:
- Reviewing and optimizing processes for needs analysis and direct customer outreach,
- Advertising, provided you have not objected to the use of your data,
- Ensuring IT security and IT operations,
- Preventing and investigating criminal offenses,
- Measures for business management and the further development of services and products.
When you use social media platforms, usage profiles are created based on your usage behavior and used to display advertisements. To this end, cookies are generally stored on your computer. If the processing is necessary to safeguard a legitimate interest of our company or a third party, and the interests, fundamental rights, and fundamental freedoms of the data subject do not override the aforementioned interest, then Article 6(1)(f) of the GDPR serves as the legal basis for the processing.
In the context of supplier relationships, there is a legal obligation to process data, e.g., due to tax law requirements (Article 6(1)(c) of the GDPR in conjunction with the German Commercial Code (HGB), the German Civil Code (BGB), the German Fiscal Code (AO), the German Income Tax Act (EStG), the German Corporate Income Tax Act (KStG), the German Trade Tax Act (GewStG), the German Value-Added Tax Act (UStG), the German Stock Corporation Act (AktG), the German Limited Liability Company Act (GmbHG), and the German Cooperative Act (GenG)).
5. Disclosure of Personal Data to Third Parties
Your personal data will be disclosed exclusively in accordance with the relevant legal requirements, in particular those relating to competition law and data protection.
To the extent necessary for the fulfillment of our contractual obligations or legal requirements, your data may also be disclosed to subcontractors or service providers to perform services on our behalf or at our request (e.g., technical handling of mail and email correspondence, payment processing, customer service).
In addition, data is disclosed to individuals or companies for the purpose of processing your booking, in particular to hosts, hotels, activity providers, travel agencies, tour operators, local service providers, government authorities, etc. Please note that data protection regulations at the locations of these individuals and companies may differ from those in Germany.
Your data may also be disclosed and transferred to third parties to the extent that we are required to do so by law or as a result of a final and binding court ruling.
You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used, and machine-readable format. You also have the right to transmit this data to another controller without hindrance from the controller to whom the personal data was provided.
6. Transfer of Data to a Third Country or an International Organization
Data will only be transferred to third countries (countries outside the European Economic Area—EEA) to the extent that this is necessary to fulfill our services, required by law, or you have given us your consent. Where required by law, we will inform you of the details.
Among other things, we use tools from companies based in the United States or other third countries that do not have a level of data protection comparable to that of the EU. When these tools are active, your personal data may be transferred to these third countries and processed there.
Please note that the United States, as a safe third country, generally maintains a level of data protection comparable to that of the EU. Accordingly, data transfers to the United States are permitted if the recipient is certified under the “EU-U.S. Data Privacy Framework” (DPF) or has appropriate additional safeguards in place.
Please note that a level of data protection comparable to that of the EU cannot be guaranteed in third countries. For example, companies are required to disclose personal data to security authorities without you, as the data subject, being able to take legal action against this. It cannot be ruled out that authorities, such as intelligence agencies, may process, analyze, and permanently store your data located on servers hosted in third countries for surveillance purposes. We have no influence over this processing activity.
6. Registration
You have the option to register on our website and create a customer/user account. To do so, you must provide an email address and a password. You can also register via Facebook or with a Google account.
We store the data required to fulfill the contract—including, if applicable, payment method information—until you permanently delete your account. The necessary data is stored until ongoing order processes are completed and active tickets have been used. You can manage and change all your information in the secure customer area.
You can delete your customer/user account at any time. Upon deletion of the account, all personal data not subject to a statutory retention obligation or Article 17(3) of the GDPR will be deleted.
The legal basis for this data processing is Article 6(1)(a), (b), and (f) of the GDPR.
7. Orders in the Online Store
We offer you the option to purchase tickets through our online store, which is provided for this purpose, and to place orders with us.
The data processed includes inventory data, communication data, contract data, and payment data; the individuals affected by this processing include our customers, prospective customers, and other business partners. Data processing is carried out for the purpose of providing contractual services in connection with the operation of an online store, billing, delivery, and customer service. In this context, we use session cookies to store the contents of the shopping cart and persistent cookies to store the login status.
You are, of course, welcome to browse our website—without having to make a purchase—to learn about the products we offer.
If you decide to purchase one or more items, these items are first placed in a shopping cart. To do this, you must register. During registration, users are informed of the required mandatory information.
After selecting your items, enter the required shipping and billing information. As a customer, you can, of course, also choose from the customer information saved from your last order. Next, select your preferred shipping service and payment method. You will then receive a summary clearly displaying all order details. You can then confirm this summary.
Once you confirm the order details, you will be redirected to the payment page for your selected payment method to complete the transaction. The order is then finalized, and you will receive a confirmation email regarding the completed order.
The processing of your personal data is based on Article 6(1), first sentence, letter b of the GDPR. Your personal data will be deleted upon expiration of the statutory retention periods, i.e., after six or ten years.
Furthermore, the legal basis for the associated data processing is Article 6(1), first sentence, f of the GDPR as well as Section 25(2), No. 2 of the TTDSG, namely our legitimate interest in enabling a smooth ordering process and the provision of our products, and in handling all your requests as efficiently as possible.
Payone
We use the services of the payment service provider Payone. Contact information: Lyoner Straße 15, 60528 Frankfurt am Main; Phone: +49 (0)69 6630-50; Email: info@payone.com. Payone will receive the data required for payment processing in connection with your purchase (e.g., email address) as well as contract data (such as order details). Your data is transferred exclusively for the purpose of payment processing. The legal basis is Article 6(1)(b) of the GDPR. We have no knowledge of the retention period at Payone and have no influence over it. For further information regarding data protection, please refer to Payone’s Privacy Policy (link: https://https://www.payone.com/DE-de/datenschutz)
PayPal
If you select payment via PayPal, your data will be transmitted to the payment service provider PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. Your data is transferred exclusively for the purpose of processing the payment and only to the extent necessary for this purpose. The legal basis is Article 6(1)(b) of the GDPR. When paying with PayPal, the bank details you have on file with PayPal will be used by PayPal to process the payment. We have no knowledge of or control over how long PayPal retains this data. For further information regarding data protection, please refer to PayPal’s Privacy Policy (link: https://www.paypal.com/de/webapps/mpp/ua/privacy-full)
8. Facebook Login
on our website, we use “Facebook Login,” a service provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, a subsidiary of Meta Platforms, Inc., 1601 S California Ave, Palo Alto, California 94304, USA (hereinafter “Facebook”). Facebook Login makes it easier for you to register for online services. This allows you to register and log in to our website using your Facebook account to access our services.
When you register via Facebook, Facebook will ask for your consent to share certain data from your Facebook account with us. This may include your first name, last name, and email address to verify your identity and gender, as well as your general location, a link to your Facebook profile, your time zone, your date of birth, your profile picture, your “Likes,” and your friends list.
This data is collected by Facebook and transmitted to us in accordance with the provisions of Facebook’s Data Policy (https://de-de.facebook.com/privacy/explanation). You can control the information we receive from Facebook through the privacy settings in your Facebook account.
This data is used to set up, provide, and personalize your account.
If you register with us via Facebook, your account will automatically be linked to your Facebook account, and information about your activities on our websites may be shared on Facebook and published on your Timeline and in your News Feed for your friends to see.
To the extent that data is processed outside the European Economic Area (EEA) or the EU, where data protection standards do not meet European standards, Facebook states that it uses standard contractual clauses.
The legal basis for accessing this information is your consent pursuant to Section 25(1) of the German Teleservices Data Protection Act (TTDSG). The legal basis for the data processing described is your consent, Article 6(1)(a) of the General Data Protection Regulation (GDPR). You can provide this consent during your first visit to the website. If you have already given your consent, you can revoke it at any time by changing your selection under “Cookie Settings.” You can find the link to the cookie settings at the bottom of this website.
You can prevent Facebook from processing the aforementioned information by using our registration form and not using Facebook Login.
9. Security Measures
We implement appropriate technical and organizational measures to ensure a level of protection appropriate to the risk, in accordance with Article 32 of the GDPR.
10. Storage and Deletion of Data
Your personal data is stored for the purposes specified under “Purpose of Collecting Personal Data.” The data subject’s personal data will be deleted or blocked as soon as the purpose for which it was stored no longer applies. Data may also be stored if this is required by European or national legislation in EU regulations, laws, or other provisions to which the controller is subject. The legislature has established a wide range of retention obligations and time limits. Data will also be blocked or deleted when a retention period prescribed by the aforementioned standards expires, unless there is a necessity for further storage of the data in accordance with Article 17(3) of the GDPR. If the data is not deleted because it is required for other, legally permissible purposes, its processing is restricted; that is, the data is blocked and not processed for other purposes. This includes data that must be retained for tax purposes.
11. Data Processing in Connection with Contact Requests
If you submit a contact request to us via the contact form, by email, or contact us by other means, we process the personal data you provide in connection with your contact request in order to respond to such requests and to handle them in a manner appropriate to the purpose of your inquiry. The legal basis for data processing is Article 6(1), first sentence, letter f) of the GDPR, as we have a legitimate interest in processing and responding to your inquiry. If your inquiry is aimed at entering into a contract with us, the legal basis for the processing of personal data is Article 6(1), first sentence, letter b) of the GDPR.
12. Automated Decision-Making in Individual Cases
Fully automated decision-making means that decisions are made using technical means without the direct involvement of a person.
Automated decision-making pursuant to Article 22 of the GDPR does not take place on our website. In the event that we use this process in individual cases, we will inform you separately—to the extent required by law.
13. Use of Data for Profiling
Profiling refers to any form of automated processing of personal data that involves using such personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person’s work performance, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.
We do not process your data for the purpose of evaluating specific personal aspects (profiling).
14. Use of Cookies and Similar Technologies
Our websites use so-called “cookies.” Cookies are small text files that do not cause any damage to your device. They are stored on your device either temporarily for the duration of a session (session cookies) or permanently (persistent cookies). Session cookies are automatically deleted at the end of your visit. Permanent cookies remain stored on your device until you delete them yourself or your web browser deletes them automatically. In some cases, cookies from third-party companies may also be stored on your device when you use our online services (third-party cookies). These enable us or you to use certain services provided by the third-party company (e.g., cookies for processing payment services).
Cookies serve various purposes. Many cookies are technically necessary, as certain website features would not work without them (e.g., the shopping cart feature or the display of videos). Other cookies are used to analyze user behavior or display advertisements.
Cookies that are required to carry out the electronic communication process, to provide certain functions you have requested (e.g., the shopping cart function), or to optimize the website (e.g., cookies for measuring website traffic) (necessary cookies), are stored on the basis of Art. 6(1)(f) GDPR, unless another legal basis is specified. The website operator has a legitimate interest in storing necessary cookies to ensure the technically error-free and optimized provision of its services. If consent to the storage of cookies and similar recognition technologies has been requested, processing is carried out exclusively on the basis of this consent (Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG); consent may be revoked at any time.
Cookies that are necessary for carrying out the electronic communication process, for providing certain functions you have requested (e.g., the shopping cart function), or for optimizing the website (e.g., cookies for measuring website traffic) (necessary cookies), are stored on the basis of Article 6(1)(f) of the GDPR, unless another legal basis is specified. The website operator has a legitimate interest in storing necessary cookies to ensure the technically error-free and optimized provision of its services. If consent to the storage of cookies and similar recognition technologies has been requested, processing is carried out exclusively on the basis of this consent (Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG); consent may be revoked at any time.
You can configure your browser to notify you when cookies are set and to allow cookies only on a case-by-case basis, to block the acceptance of cookies in specific cases or generally, and to enable the automatic deletion of cookies when you close your browser. Disabling cookies may limit the functionality of this website.
To the extent that cookies from third-party companies or for analytical purposes are used, we will inform you separately about this within the scope of this Privacy Policy and, if necessary, request your consent.
You can configure your browser to notify you when cookies are set and to allow cookies only on a case-by-case basis, to block cookies in specific cases or generally, and to enable the automatic deletion of cookies when you close your browser. Disabling cookies may limit the functionality of this website.
To the extent that cookies from third-party companies or for analytical purposes are used, we will inform you separately about this within the scope of this Privacy Policy and, if necessary, request your consent.
If cookies from third-party companies or for analytical purposes are used, we will inform you separately about this in this Privacy Policy and, if necessary, request your consent.
Unfortunately, using our services without accepting cookies is only possible to a limited extent. We therefore recommend that you permanently enable cookies for our website. By accepting additional functional cookies, we can improve the user experience and tailor our services to your preferences. Most web browsers are set to automatically accept cookies. However, you can disable the storage of cookies and configure your web browser to notify you as soon as cookies are sent. The legal basis for the use of cookies is our legitimate interest pursuant to Art. 6(1)(f) of the GDPR.
For individual configuration, we provide a cookie consent tool; you can find more details about it in the section below.
The tracking measures listed below and used by us are carried out on the basis of Article 6(1)(f) of the GDPR and serve to tailor our website to your needs and to continuously optimize it.
15. Use of the Borlabs Cookie to Manage Cookie Consents
Our website uses the Borlabs Cookie, which sets a technically necessary cookie (borlabs-cookie) to store your cookie consents.
The Borlabs Cookie does not process any personal data.
The borlabs-cookie stores the consents you provided when you first accessed the website. If you wish to revoke these consents, simply delete the cookie in your browser. When you visit the website again or reload the page, you will be asked for your cookie consent once more.
16. Use of Google Analytics
This website uses Google Analytics, a web analytics service provided by Google Inc. Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics uses so-called “cookies,” which are text files stored on your computer that enable an analysis of your use of the website. The information generated by the cookie about your use of this website (including your IP address) is transmitted to a Google server in Ireland and stored there. Google will use this information to evaluate your use of the website, to compile reports on website activity for the website operators, and to provide other services related to website and internet usage. Google may also transfer this information to third parties where required by law or where such third parties process the data on Google’s behalf. Google will never associate your IP address with any other data held by Google. You can prevent the installation of cookies by adjusting your browser settings accordingly; however, please note that in this case, you may not be able to use all features of this website to their full extent. By using this website, you consent to the processing of data collected about you by Google in the manner and for the purposes described above. The Google tracking codes on this website use the “anonymizeIp” function, which means that IP addresses are processed in a truncated form to prevent direct personal identification. You may object to the collection and storage of data at any time with future effect. Clicking the “Disable” button will completely prevent tracking. For the objection to take effect permanently, the browser you are using must accept cookies. Alternatively, you can object to data collection by using a Google browser plugin to prevent the information collected by cookies (including your IP address) from being sent to Google Ireland Limited and used by Google Ireland Limited.
The following link will take you to the corresponding plugin: https://tools.google.com/dlpage/gaoptout?hl=de. The legal basis for the use of Google Analytics is our legitimate interest pursuant to Art. 6(1)(f) of the GDPR.
You can find the privacy policy at:
https://policies.google.com/privacy?hl=en
17. Use of Google Tag Manager
Our website uses Google Tag Manager, a tool for managing website tags provided by Google Inc. Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Tag Manager itself does not store any personal data. Tag Manager organizes access to other tags, which may in turn collect data. However, Google Tag Manager does not access this data. If Google Tag Manager has been disabled at the domain or cookie level, this setting remains in effect for all tracking tags implemented using Google Tag Manager. The use of Google Tag Manager constitutes a legitimate interest within the meaning of Article 6(1)(f) of the GDPR.
Transfers to third countries are possible. So-called standard contractual clauses pursuant to Article 46 of the GDPR have been agreed upon as appropriate safeguards. For third countries/companies for which an adequacy decision has been issued, that adequacy decision also applies.
18. Use of Google Maps
Our website uses Google Maps and the Google Maps API to visually display a map and geographic information. When Google Maps is used, Google also collects, processes, and uses data regarding visitors’ use of the Maps features.
We use Google Maps to present our online offerings in an appealing way and to make it easy for users to find the locations listed on our website. This constitutes a legitimate interest within the meaning of Article 6(1)(f) of the GDPR.
If consent has been requested, processing is carried out exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s device (e.g., device fingerprinting) within the meaning of the TDDDG. Consent may be revoked at any time.
Data transfers to the United States are based on the EU Commission’s Standard Contractual Clauses. Details can be found here:
https://privacy.google.com/businesses/gdprcontrollerterms/ and
https://privacy.google.com/businesses/gdprcontrollerterms/sccs/.
For more information on how user data is handled, please see Google’s Privacy Policy:
https://policies.google.com/privacy?hl=de
There, you can also change your settings in the Privacy Center so that you can manage and protect your data. The Google Maps Terms of Service can be found at https://www.google.com/intl/de_de/help/terms_maps.html
For more information about data processing by Google, please refer to Google’s Privacy Policy at http://www.google.com/privacypolicy.html. There, you can also change your settings in the Privacy Center so that you can manage and protect your data. The legal basis for the use of Google Maps is our legitimate interest pursuant to Art. 6(1)(f) of the GDPR. The Google Maps Terms of Service can be found at https://www.google.com/intl/de_de/help/terms_maps.html
19. Security, Questions, and Suggestions
Security depends, not least, on your system. You should always keep your login information confidential, never allow your web browser to save passwords, and close the browser window when you finish visiting our website. This will make it more difficult for third parties to access your personal data.
Use an operating system that allows you to manage user rights. Set up multiple user accounts on your system for family members, and never use the Internet with administrator privileges. Use security software such as antivirus programs and firewalls, and keep your system up to date at all times.
20. Right of Access / Right of Withdrawal; Other Data Subject Rights
You have the right to:
• to request information about your personal data processed by us in accordance with Article 15 of the GDPR. In particular, you may request information regarding the purposes of processing, the categories of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned retention period, the existence of a right to rectification, erasure, restriction of processing, or objection; the existence of a right to lodge a complaint; the origin of your data, if it was not collected by us; and the existence of automated decision-making, including profiling, and, where applicable, meaningful information regarding its details;
• pursuant to Article 16 of the GDPR, to request the immediate rectification of inaccurate personal data or the completion of your personal data stored by us;
• pursuant to Article 17 of the GDPR, to request the erasure of your personal data stored by us, unless processing is necessary for the exercise of the right to freedom of expression and information, to fulfill a legal obligation, for reasons of public interest, or to assert, exercise, or defend legal claims;
• to request, pursuant to Article 18 of the GDPR, the restriction of the processing of your personal data if you contest the accuracy of the data, if the processing is unlawful but you oppose its erasure and we no longer need the data, but you require it to assert, exercise, or defend legal claims, or if you have objected to the processing pursuant to Article 21 of the GDPR;
• pursuant to Article 20 of the GDPR, to receive your personal data that you have provided to us in a structured, commonly used, and machine-readable format, or to request that it be transmitted to another controller;
• pursuant to Article 7(3) of the GDPR, to withdraw your consent at any time. As a result, we may no longer continue processing the data based on that consent in the future; and
• pursuant to Article 77 of the GDPR, to lodge a complaint with a supervisory authority. As a rule, you may contact the supervisory authority at your usual place of residence, your place of work, or our corporate headquarters for this purpose
• Right to object to data collection in specific cases and to direct marketing (Article 21 of the GDPR):
If data processing is based on Article 6(1)(e) or (f) of the GDPR, you have the right at any time to object to the processing of your personal data on grounds relating to your particular situation; this also applies to profiling based on this provision. The specific legal basis on which processing is based can be found in this Privacy Policy. If you object, we will no longer process your personal data in question unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims (objection under Article 21(1) of the GDPR).
If your personal data is processed for the purpose of direct marketing, you have the right to object at any time to the processing of your personal data for such marketing purposes; this also applies to profiling to the extent that it is related to such direct marketing. If you object, your personal data will no longer be used for the purposes of direct marketing (objection under Article 21(2) of the GDPR).
You are, of course, entitled to exercise this right free of charge. To revoke your consent to the use of your data, to request access to your data or its correction, restriction, or erasure, or to exercise any other data subject rights, please contact:
Partnachklamm
Address: Partnachklamm, 82467 Garmisch-Partenkirchen,
VAT ID: DE128378289
Email address: partnachklamm-webshop@gapa.de
Contact information for the Data Protection Officer:
Email: datenschutz@gapa.de
To exercise your rights as a data subject—such as the right to access, rectify, restrict, or erase your personal data—please do not contact the Data Protection Officer directly. Instead, please first contact the aforementioned department of the Data Controller directly, which will process your request without delay.
21. Competent Supervisory Authority
You can contact the supervisory authority responsible for handling your complaints within the meaning of Article 77 of the GDPR using the following contact information:
Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18
91522 Ansbach
Phone: +49 (0) 981 53 1300
Fax: +49 (0) 981 53 98 1300
Email: poststelle@lda.bayern.de
Date of this version: July 2025