Privacy Policy

1. Quick guide to data protection

General

The following information summarises what happens to your personal data when you visit this website. Personal data are all data by which you can be identified personally. Please refer to our Privacy Policy below for detailed information on the subject of data protection.

Data collected on this website

Who is responsible for data collection on this website?
Data processing on this website is performed by the website operator. Their contact details are available in the "Data controller information" section of this Privacy Policy.

How do we process your data?

We use personal data to operate our website and online shop. One way of collecting data is by means of you providing us with your details. This includes data that you enter on a contact form.

Other data are collected automatically by our IT systems or subject to your consent when you access our website. These data are mainly of a technical nature such as

• Name und URL der abgerufenen Datei
• Datum und Uhrzeit des Abrufs
• Internetbrowser, Betriebssystem, übertragene Datenmenge
• Referrer URL (zuvor besuchte Seite)
• Websites, welche vom System des Nutzers über unsere Website aufgerufen werden
• IP-Adresse und der anfragende Provider (letzte Zahl anonymisiert) sowie bei der Nutzung des Online-Shop (bookingkit)
• Name, Anschrift, Geburtsdatum, EmailAdresse, Telefonnummer, IBAN, BIC, Bezahlart
• Cookie/Sitzungsidentifikationsnummer, IP-Adresse, Zeitstempel, Login-Daten.

These data are collected automatically as soon as you access this website or use the online shop.

What do we use your data for?

Some of the data are collected to ensure the error-free function of the website. Other data may be used to analyse your user behaviour.

What rights do you have with regard to your data?

You are entitled to receive information about the origin, recipient and purpose for which we store your personal data free of charge. You also have the right to the rectification or deletion of these data. If you have consented to data processing, you can revoke your consent at any time for the future. In addition, under certain circumstances, you have the right to demand a restriction of the processing of your personal data. You are also entitled to file complaints with the responsible supervisory authority. You can contact us on this and other matters relating to data protection at any time. You can store and print out the Privacy Policy at any time.
Data transmission to third countries (booking kit): during your use of the online shop, data are transmitted to third countries outside the European Union. Transmission is based on contractual provisions provided for by law, which are designed to afford your data adequate protection and which you can view on request.

Analysis tools and tools of third-party providers

When you access this website, your surfing behaviour may be evaluated statistically. This is mainly performed by analysis programs. Detailed information about these analysis programs is provided in the Privacy Policy below.

DThird-party services

We work with booking kit to operate of the online shop for the sale of tickets. Payment transactions are handled via MangoPay or PayPal. Ticket sales are also handled via GetYourGuide. This enterprise only receives personal data to the extent required for the fulfilment of the relevant service. We pledge data processors under contract to only use personal data in compliance with the requirements of data protection legislation and to ensure that the rights of the data subject are safeguarded.
Please refer to the privacy statement of bookingkit for details:
https://bookingkit.com/privacy-statement/

2. Hosting

Hetzner

Our website is hosted by Hetzner. The provider is Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen (hereinafter referred to as Hetzner). Please refer to Hetzner's privacy policy for details:
https://www.hetzner.com/legal/privacy-policy
Use of Hetzner's services is based on Article 6 1) (1 f) GDPR. We hold a legitimate interest in the most reliable presentation of our website. Insofar as the relevant consent was requested, processing is based solely on Article 6 (1) (a) GDPR and Section 25 (1) of the German Telecommunications-Telemedia Data Protection Act (TTDSG); insofar as the consent to the storage of cookies or access to information on the user's peripheral device (e.g. device fingerprinting) is included within the meaning of the TTDSG. Consent may be revoked at any time.

SSL or TLS encryption

For security reasons and to protect the transmission of confidential content such as orders or inquiries that you send to us as website operator, this website employs SSL or TLS encryption.
Encrypted connections can by identified by the address line of the browser when it switches from http:// to https:// and by the padlock symbol in your browser line. When SSL or TLS encryption is activated, the data that you send us cannot be accessed by third parties.

3. General and mandatory information

Data privacy

The operator of this website takes the protection of your personal data very seriously. We treat your personal data confidentially and in compliance with statutory data protection regulations and this Privacy Policy.
Wenn Sie diese Website benutzen, werden verschiedene personenbezogene Daten erhoben.
Personal data are data by which you can be identified personally. This Privacy Policy sets out which data we collect and what we use it for. It also explains how and for what purpose your data is collected.
Please note that data transmission in the internet (such as communication via email) may be subject to security gaps. Seamlessly protecting data from access by third parties is not possible.

Controller information
The controller responsible for data processing on this website is:

Förderverein Nürnberger Felsengänge e.V.
Albrecht-Dürer-Strasse 21
D-90403 Nuremberg
Telephone: +49 (0) 911 22 70 66
Email: info@felsengaenge-nuernberg.de
Chairperson: Ralf Arnold

Controller means the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data (e.g. names, email addresses etc.).

Retention period

Unless a more specific retention period is set out in this Privacy Policy, we will keep your personal data until the purpose of the data processing ceases to exist. If you assert a legitimate right to deletion or revoke your consent to data processing, we will delete your personal data unless other legally permissible reasons for their storage exists (such as retention periods under tax or trade law); in the latter case, your data will be deleted when saidreasons cease to exist.
When using the bookingkit online shop, data are stored

• wenn Sie in die Verarbeitung eingewilligt haben, höchstens so lange, bis Sie Ihre Einwilligung widerrufen
• wenn wir die Daten zur Durchführung eines Vertrages benötigen, höchsten solange, wie das Vertragsverhältnis mit Ihnen besteht oder gesetzliche Aufbewahrungsfristen laufen

General information regarding the legal grounds for data processing on this website

Providing that you have consented to data processing, we shall process your personal data on the basis of Article 6 (1)(a) GDPr or Article 9 (2)(a) GDPR insofar as special data categories pursuant to Article 9(1) GDPR are processed. In case of an express consent to the transfer of personal data to third countries, data processing shall also take place on the basis of Article 49 (1)(a) GDPR. Providing that you have consent to the storage of cookies or to access to information on your peripheral device (e.g. via device fingerprinting), data processing shall also take place on the basis of Section 25 (1) TTDSG. Consent may be revoked at any time. If your data are required to fulfil a contract or to perform pre-contractual measures, we shall process your data on the basis of Article 6 (1)(b) GDPR. In addition, we shall process your data should they be required to fulfil a legal obligation on the basis of Article 6 (1)(c) GDPR. Data processing may also take place on the basis of our legitimate interest in accordance with Article 6 (1)(f) GDPR. The following sections of this Privacy Policy set out the relevant legal grounds in the respective individual cases.

Revocation of your consent to data processing

Many data processing operations are only possible with your express consent. You can revoke a consent that you have given at any time. The legitimacy of the data processing that has taken place up until your revocation shall remain unaffected by said revocation.
Right to object to the collection of data in special cases as well as for direct marketing purposes (Article 21 GDPR)

If data processing is based on Article 6 (1)(e) or (f), you are entitled at any time to object to the processing of your personal data on grounds arising from your particular circumstances; this also applies to profiling based on these provisions. Please refer to this Privacy Policy for the relevant legal grounds on which processing is based. If you file your objection, we will no longer process your personal data in question, unless we can furnish compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims (Right to object in accordance with Article 21 (1) GDPR.
If your personal data are processed for direct marketing purpises, you shall have the right to object at any time to processing of your personal data for such marketing, which includes profiling to the extent that it is related to such direct marketing. If you object to processing for direct marketing purposes, your personal data shall then no longer be processed for such purposes (right to object in accordance with Article 21 (2) GDPR.
Automated decision making including profiling
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.
Automated decision making based on the personal data collected does not take place.
Recht auf Beschwerde bei der zuständigen Aufsichtsbehörde
Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work or place of the alleged infringement.

Right to data portability

You have the right to receive the personal data concerning you, which we have processed automatically on the basis of your consent or to fulfil a contract, in a structured, commonly used and machine-readable format. Should you demand their direct transmission to another controller this shall only be performed should it be technically feasible.

Right to information, deletion and rectification

Under the applicable legal provisions, you have the right to be informed at any time free of charge as to your stored personal data, where it was sourced, its recipients and the purpose of data processing, as well as if necessary, a right to rectification or deletion of these data. You are welcome to contact us at any time with question about this and other matters relating to personal data.

Right of restriction of processing

You have the right to demand that the processing of your personal data be restricted. You can contact us at any time on this matter. The right to restriction of processing is constituted in the following cases:
If you dispute the correctness of the personal data we have stored about you, we generally need time to verify this. While we are verifying your claim, you have the right to restrict the processing of your personal data.

Ifyour personal data were/are being processed illegally, instead of deletion you may demand that data processing be restricted.
If we no longer need your personal data, but you require them to exercise, defend or assert legal claims, you have the right to demand that instead of deletion, you may demand the restriction of processing of your personal data.

If you have filed an objection in accordance with Article 21 (1) GDPR, an analysis of your and our interests must be conducted. Until it is decided as to whose interests take precedence, you have the right to demand that the processing of your personal data be restricted.

If you have restricted the processing of your personal data, with the exception of their storage, said data may only be processed with your consent or to protect the rights of another natural or legal person or on grounds of an important public interest of the European Union or of one of the Member States.

Data collected on this website

Log files

We use log files without relating them to your person or other profiling in order to perform statistical evalutions for the operation, security and optimisation of our website, as well as for anonymously recording the number of visitors to our website (traffic) and the extent and nature of the use of our website and services, and for billing purposes in order to measure the number of clicks received by our cooperation partners. On the basis of this information we can provide personalised and site-related content, analyse data traffic, seek and eliminate errors, and improve our services. This also constitutes our legitimate interest in accordance with Article 6 (1)(f) GDPR.
We reserve the right to subsequently check log files should specific evidence support a justified suspicion of unlawful usage. IP addresses are stored in the log files for a limited period should this be necessary for security purposes or for the performance or billing of a service, for example if you use one of our products. On cancelling the order process or upon receipt of payment we delete the IP address if it is no longer required for security purposes. We also store IP addresses in case of a specific suspicion of an offence being committed in connection with the use of our website. In addition, we store the date of your last visit as part of your account (e.g. on registration, login, clicking links, etc.).

Cookies

Our internet website uses cookies. Cookies are small text files and they do not harm your peripheral device. They are stored either temporarily on your peripheral device for the duration of a session (session cookies) or permanently (permanent cookies). Session cookies are deleted automatically at the end of your visit. Permanent cookies remain stored on your peripheral device until you delete them or they are deleted automatically by your web browser.
In some cases, cookies of third-party companies (third-party cookies) may also be stored on your peripheral device when you visit our website. This enables us or you to use certain services of the third-party company (e.g. cookies for handling payment services, specifically bookingkit, PayPal or MangoPay). Cookies have various functions. Many cookies are necessary for technical purposes, as certain website functions would not work without them (e.g. the shopping basket function or displaying of videos). Other cookies are used to evaluate user behaviour or to display advertising. Cookies that are required to perform the electronic communication process, provide certain functions you want (e.g. the shopping basket function) or to optimise the website (e.g. cookies for measuring the web audience) are stored on the basis of Article 6 (1)(f) GDPR, providing that no other legal basis is specified.
The website operator holds a legitimate interest in the storage of necessary cookies for the technically error-free and optimised provision of their services. Provided that consent to the storage of cookies and comparable recognition technologies has been requested, processing shall be conducted solely on the basis of this consent (Article 6 (1)(a) GDPR and Section 25 (1) TTDSG); consent may be revoked at any time.
You can adjust your browser settings so that you are notified about the setting of cookies and only allow cookies in individual cases, accept cookies in specific cases, exclude them generally or activate the automatic deletion of cookies on closing your browser. Deactivating cookies may limit the functionality of this website.
Should cookies be used from third-party companies or for analysis purposes, we shall inform you of such separately within the framework of this Privacy Policy and if necessary, we shall request your consent.
(bookingkit) Cookies used by bookingkit for instance:

Cookie group/storage time of cookies used/description

Widget, internal cookies / up to one month / These cookies enable the checkout funktion and save the shopping basket for re-login. User experience and friendliness are tracked anonymously in order to improve service for end customers.
Widget, payment processing cookie / until the end of the session / used for online payment processing, based on the payment method selected at checkout.
Widget, Google Analytics / up to 24 months / User experience and friendliness are tracked anonymously in order to improve service for end customers.
Performance, interne cookies / up to 24 months / JavaScript API for handling browser cookies, which are used by the bookingkit website CRM to manage cookies. This cookie saves information on language preference.
Performance, Google Analytics / up to 24 months / registers a unique ID, with which statistical data are generated relating to how the visitor uses the website.
Personalised, Google Maps / up to six months / used to determine which website sent your request and from which IP address it was sent.
For more information please refer to the bookingkit privacy statement:
https://bookingkit.com/privacy-statement/

Contact form

Wenn Sie uns per Kontaktformular Anfragen zukommen lassen, werden Ihre Angaben aus dem Anfrageformular inklusive der von Ihnen dort angegebenen Kontaktdaten zwecks Bearbeitung der Anfrage und für den Fall von Anschlussfragen bei uns gespeichert. Diese Daten geben wir nicht ohne Ihre Einwilligung weiter.
Processing of these data is based on Article 6 (1)(b) GDPR provided that your inquiry is related to the fulfilment of a contract or is required for the performance of pre-contractual measures. In all other cases processing is based on our legitimate interest in the effective processing of the inquiries sent to us (Article 6 (1)(f) GDPR) or on your consent (Article 6 (1)(a) GDPR) provided that the latter has been requested; consent may be revoked at any time.
If data processing is performed to carry out pre-contractual measures conducted on the basis of your inquiry or if you are already our customer, to carry out the contract, the legal basis for this data processing is Article 6 (1)(1)(b) GDPR.
We shall only process additional personal data if you consent to this (Article 6 (1)(1)(a) GDPR) or if we hold a legitimate interest in the processing of your data (Article 6 (1)(1)(f) GDPR. A legitimate interest may be that of answering your email for instance.

The data you entered in the contact form shall remain with us until you request their deletion, you revoke your consent to their storage or the purpose of the data storage ceases to exist (e.g. once your inquiry has been processed). Compelling legal provisions – in particular retention periods – shall remain unaffected.

Anfrage per E-Mail, Telefon oder Telefax

Wenn Sie uns per E-Mail, Telefon oder Telefax kontaktieren, wird Ihre Anfrage inklusive aller daraus hervorgehenden personenbezogenen Daten (Name, Anfrage) zum Zwecke der Bearbeitung Ihres Anliegens bei uns gespeichert und verarbeitet. Diese Daten geben wir nicht ohne Ihre Einwilligung weiter.
Processing of these data is based on Article 6 (1)(b) GDPR provided that your inquiry is related to the fulfilment of a contract or is required for the performance of pre-contractual measures. In all other cases processing is based on our legitimate interest in the effective processing of the inquiries sent to us (Article 6 (1)(f) GDPR) or on your consent (Article 6 (1)(a) GDPR) provided that the latter has been requested; consent may be revoked at any time.
The data you sent to us via contact inquiries shall remain with us until you request their deletion, you revoke your consent to their storage or the purpose of the data storage ceases to exist (e.g. once your matter of concern has been processed). Compelling legal provisions – in particular retention periods – shall remain unaffected.

5. Newsletter

Newsletter data

If you should like to receive the newsletter offered on the website, we need an email address from you, as well as information which enables us to verify that you are the owner of the email address specified and that you consent to receiving the newsletter (captcha information). Additional data shall not be collected or only on a voluntary basis. We shall only use these data to send the requested information and we shall not pass them on to third parties.

Processing of the data entered on the newsletter registration form shall take place solely on the basis of your consent (Article 6 (1)(a) GDPR). You may revoke your consent to storage of the data, the email address as well as their use to send the newsletter at any time, for instance by clicking the unsubscribe link in the newsletter. The legitimacy of the foregoing data processing operations shall remain unaffected by the revocation of consent.

We or the newsletter provider shall store the data you provided in order to receive the newsletter until you unsubscribe from the newsletter. Your data shall be deleted from the newsletter distribution list on unsubscribing from the newsletter or their no longer being necessary in relation to the purpose of which they were collected. We reserve the right to delete or to block email addresses in our newsletter distribution list at our discretion within the context of our legitimate interest in accordance with Article 6 (1)(f) GDPR. Data stored by us for other purposes shall remain unaffected by this.
On removal from the newsletter distribution list, your email adress may be stored by us or the newsletter provider in a black list should this be necessary to prevent future mailings. The data in the black list shall only be used for this purpose and they shall not be combined with other data. This serves both your interest and also our interest in complying with the legal regulations for the sending of newsletters (legitimate interest within the meaning of Article 6 (1)(f) GDPR). Storage on the black list is not time-limited. You may object to storage insofar as your interests override our legitimate interest.

This Privacy Policy was drafted with the help of https://www.e-recht24.de.