General Data Processing

Scope and Permission to Process Data

In principle, we only collect and use personal data of our users insofar as this is necessary to provide the functionality of our website and our content and services. The collection and use of personal data of our users takes place regularly only with the consent of the user. An exception applies in those cases in which prior consent cannot be obtained for practical reasons and the processing of the data is permitted by law. The legal basis for the processing of personal data with prior consent of the data subject is Art. 6 Para. 1 lit. a GDPR. The legal basis for the processing of personal data that is required to fulfill a contract or to carry out pre-contractual measures is Art. 6 Para. 1 lit. b GDPR. When processing personal data to fulfill a legal obligation, the legal basis is Art. 6 Paragraph 1 lit. c GDPR. In the event that vital interests of the data subject or another natural person require the processing of personal data, Art. 6 para. 1 lit. d GDPR as the legal basis. If processing is necessary to safeguard a legitimate interest of our company or a third party and if these interests outweigh the interests of the person concerned, taking into account the fundamental rights and freedoms of the person concerned, Art. 6 Para. 1 lit. f GDPR the legal basis for processing the data.

Data Cancellation and Storage Duration

The personal data of the data subject will be deleted or blocked as soon as the purpose of storage no longer applies. Storage can also take place if this is provided for by a statutory provision for processing the data. In this case, the data will be blocked or deleted when the legally prescribed storage period expires, unless there is a need for further storage of the data in order to conclude or fulfill a contract.

Data Processing through the Use of our Website

Use of the FoL App

When you call up our Festival of Lights (FoL) app, the browser used on your device automatically sends information to the server of our app. This information is temporarily stored in a so-called log file. The following information is recorded without any action on your part and stored until it is automatically deleted: IP address of the requesting computer, date and time of access, name and URL of the file accessed, website from which access was made (referrer URL), used Browser and possibly the operating system of your computer as well as the name of your access provider. The data mentioned are processed by us for the purpose of ensuring a smooth connection of the app, ensuring comfortable use of our app, evaluating system security and stability and for other administrative purposes. The legal basis for data processing is Art. 6 Para. 1 S. 1 lit. f GDPR. Our legitimate interest follows from the purposes of data collection listed above. In no case do we use the collected data for the purpose of drawing conclusions about you personally.

Contact

You can contact us via the email address provided. In this case, the user's personal data transmitted with the email will be saved. In this context, the data will not be passed on to third parties. The legal basis for processing this data is Art. 6 Para. 1 lit. f GDPR. If the aim of the email contact is to conclude a contract, the additional legal basis for processing is Art. 6 Para. 1 lit. b GDPR. The data processing for the purpose of contacting us takes place in accordance with Art. 6 Para. 1 S. 1 lit. a GDPR based on your voluntarily given consent. The personal data collected by us for using the contact form will be automatically deleted after your request has been dealt with.

Transfer of Data

A transfer of your personal data to third parties for purposes other than those listed below does not take place. We will only pass on your personal data to third parties if you have given your consent in accordance with Art. 6 Paragraph 1 S. 1 lit. a DSGVO have given express consent to the disclosure according to Art. 6 Para. 1 S. 1 lit. f GDPR is required to assert, exercise or defend legal claims and there is no reason to assume that you have an overriding legitimate interest in not disclosing your data in the event that disclosure pursuant to Art. 6 Para. 1 S. 1 lit. c GDPR there is a legal obligation, as well as this is legally permissible and according to Art. 6 Para. 1 S. 1 lit. b GDPR is necessary for the processing of contractual relationships with you.

Use of Cookies

We use cookies to operate our website in order to make it more user-friendly. Some elements of our website require that the calling browser can also be identified after changing pages. Cookies are small files that make it possible to save specific, device-related information on the user's access device (PC, smartphone, etc.). On the one hand, they serve the user-friendliness of websites and thus the users (e.g. storage of login data). On the other hand, they are used to record statistical data on website usage and to be able to analyze them in order to improve the offer. The users can influence the use of cookies. Most browsers have an option to restrict or completely prevent the storage of cookies. However, it should be noted that the use and in particular the ease of use are restricted without cookies. The user data collected in this way is pseudonymised by technical precautions. It is therefore no longer possible to assign the data to the calling user. The data is not stored together with other personal data of the user. The legal basis for the processing of personal data using cookies is Art. 6 Para. 1 lit. f GDPR. The legal basis for processing personal data using technically necessary cookies is Article 6 Paragraph 1 lit. f GDPR. The legal basis for the processing of personal data using cookies for analysis purposes is Article 6 Paragraph 1 lit. a GDPR. The purpose of using technically necessary cookies is to simplify the use of websites for users. Some functions of our website cannot be offered without the use of cookies. For this it is necessary that the browser is recognized even after changing pages. The analysis of cookies are used for the purpose of improving the quality of our website and its content. The analysis of cookies tell us how the website is used and so we can continuously optimize our offer. Our legitimate interest in processing personal data in accordance with Art. 6 Paragraph 1 lit. f GDPR.

Third Party Services

We have integrated content, services and services from other providers on the website. These are, for example, maps provided by Google Maps, videos from YouTube and graphics and images from other websites. In order for this data to be called up and displayed in the user's browser, the transmission of the IP address is essential. The providers (hereinafter referred to as "third-party providers") thus perceive the IP address of the respective user. Even if we endeavour to only use third-party providers who only need the IP address in order to be able to deliver content, we have no influence on whether the IP address is possibly saved. In this case, this process serves, among other things, statistical purposes. If we know that the IP address is being saved, we will inform our users of this.

Application and Use of Facebook

The person responsible for processing has integrated components of the company Facebook on this website. Facebook is a social network. A social network is a social meeting place operated on the Internet, an online community that usually enables users to communicate with one another and to interact in virtual space. A social network can serve as a platform for exchanging opinions and experiences, or it enables the Internet community to provide personal or company-related information. Among other things, Facebook enables users of the social network to create private profiles, upload photos and network via friend requests. The operating company of Facebook is Facebook, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA. If a data subject lives outside the USA or Canada, the person responsible for processing personal data is Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbor, Dublin 2, Ireland. Each time one of the individual pages of this website is accessed, which is operated by the person responsible for processing and on which a Facebook component (Facebook plug-in) has been integrated, the Internet browser on the information technology system of the person concerned is automatically activated by the respective Facebook -Component causes a representation of the corresponding Facebook component to be downloaded from Facebook. A complete overview of all Facebook plug-ins can be found at https://developers.facebook.com/docs/plugins/?locale=de_DE can be accessed. As part of this technical process, Facebook receives knowledge of which specific subpage of our website is visited by the person concerned. If the person concerned is logged into Facebook at the same time, Facebook recognizes with each visit to our website by the person concerned and for the entire duration of the respective stay on our website, which specific subpage of our website the person concerned is visiting. This information is collected by the Facebook component and assigned to the respective Facebook account of the person concerned by Facebook. If the person concerned activates one of the Facebook buttons integrated on our website, for example the "Like" button, or if the person concerned makes a comment, Facebook assigns this information to the person concerned’s personal Facebook user account and saves this personal data. Facebook always receives information via the Facebook component that the person concerned has visited our website. If the person concerned is logged into Facebook at the same time as accessing our website; this takes place regardless of whether the person concerned clicks on the Facebook component or not. If the data subject does not want this information to be transmitted to Facebook, they can prevent the transmission by logging out of their Facebook account before calling up our website. The data guideline published by Facebook, which is available at https://de- de.facebook.com/about/privacy/, provides information about the collection, processing and use of personal data by Facebook. It also explains which setting options Facebook offers to protect the privacy of the person concerned. In addition, different applications are available that make it possible to suppress data transmission to Facebook, for example the Facebook blocker from the provider Webgraph, which can be obtained from http://webgraph.com/resources/facebookblocker/. Such applications can be used by the data subject to suppress data transmission to Facebook.

Application and Use of Instagram

The controller has integrated components of the Instagram service on this website. Instagram is a service that qualifies as an audiovisual platform and enables users to share photos and videos and also to disseminate such data in other social networks. The operating company for Instagram services is Instagram LLC, 1 Hacker Way, Building 14 First Floor, Menlo Park, CA, USA. Each time one of the individual pages of this website is accessed, which is operated by the person responsible for processing and on which an Instagram component (Insta button) has been integrated, the Internet browser on the information technology system of the person concerned is automatically replaced by the respective Instagram component causes a representation of the corresponding component to be downloaded from Instagram. As part of this technical process, Instagram receives information about which specific subpage of our website is visited by the person concerned. If the person concerned is logged in to Instagram at the same time, Instagram recognizes which specific sub-page the person concerned is visiting with each visit to our website by the person concerned and for the entire duration of the respective stay on our website. This information is collected by the Instagram component and assigned to the respective Instagram account of the person concerned by Instagram. If the person concerned clicks one of the Instagram buttons integrated on our website, the data and information transferred with it are assigned to the personal Instagram user account of the person concerned and stored and processed by Instagram. Instagram always receives information via the Instagram component that the person concerned has visited our website. If the person concerned is logged in to Instagram at the same time as accessing our website; this takes place regardless of whether the person concerned clicks on the Instagram component or not. If the data subject does not want this information to be transmitted to Instagram, they can prevent the transmission by logging out of their Instagram account before calling up our website. Further information and Instagram's applicable data protection regulations can be found at https://help.instagram.com/155833707900388 and https://www.instagram.com/about/legal/privacy/.

Application and Use of YouTube

We have integrated components from YouTube on our website. YouTube is an Internet video portal that enables video publishers to post video clips free of charge and other users to view, rate and comment on them free of charge. YouTube allows the publication of all types of videos, which is why complete film and TV programs, but also music videos, trailers or videos made by users themselves can be accessed via the Internet portal. YouTube is operated by YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. YouTube, LLC is a subsidiary of Google Inc., 1600 Amphitheater Pkwy, Mountain View, CA 94043-1351, USA. Each time one of the individual pages of this website is accessed, which is operated by the person responsible for processing and on which a YouTube component (YouTube video) has been integrated, the Internet browser on the information technology system of the person concerned is automatically replaced by the respective YouTube component prompts you to download a representation of the corresponding YouTube component from YouTube. Further information on YouTube can be found at https://www.youtube.com/yt/about/de/. As part of this technical process, YouTube and Google gain knowledge of which specific subpage of our website is visited by the person concerned. If the person concerned is logged in to YouTube at the same time, YouTube recognizes which specific sub-page of our website the person concerned is visiting by calling up a subpage that contains a YouTube video. This information is collected by YouTube and Google and assigned to the respective YouTube account of the person concerned. YouTube and Google always receive information via the YouTube component that the person concerned has visited our website if the person concerned is logged in to YouTube at the same time as accessing our website; this takes place regardless of whether the person concerned clicks on a YouTube video or not. If the data subject does not want this information to be transmitted to YouTube and Google, they can prevent the transmission by logging out of their YouTube account before calling up our website. The data protection regulations published by YouTube, which are available at https://www.google.de/intl/de/policies/privacy/, provide information about the collection, processing and use of personal data by YouTube and Google.

Application and Use of Google-Maps

We use the "Google Maps" component from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, hereinafter "Google", on our website. Each time the "Google Maps" component is called up, Google sets a cookie in order to adjust the user settings when the page on which the "Google Maps" component is integrated is displayed and process data. As a rule, this cookie is not deleted when you close the browser, but expires after a certain period of time, unless you delete it manually beforehand. If you do not agree to this processing of your data, you have the option of deactivating the "Google Maps" service and thereby preventing the transmission of data to Google. To do this, you need to deactivate the Java Script function in your browser. However, we would like to point out that in this case you will not be able to use "Google Maps" or only to a limited extent. "Google Maps" and the information obtained through "Google Maps" are used in accordance with the Google Terms of Use http://www.google.de/intl/de/policies/terms/regional.html and the additional terms and conditions for "Google Maps https://www.google.com/intl/de_de/help/terms_maps.html."

Cooperation with Contract Processors, jointly responsible people and third parties

If we disclose data to other persons and companies (contract processors, jointly responsible persons or third parties) within the scope of our processing, transmit them to them or otherwise grant them access to the data, this is only done on the basis of legal permission (e.g. if the data is transmitted to third parties, such as payment service providers to fulfill the contract), users have consented, a legal obligation provides for this or based on our legitimate interests (e.g. when using agents, web hosts, etc.). If we disclose, transmit or otherwise grant access to data to other companies in our group of companies, this is done in particular for administrative purposes as a legitimate interest and, moreover, on a basis that complies with legal requirements.

Transfers to Third Countries

If we process data in a third country (i.e. outside the European Union (EU), the European Economic Area (EEA) or the Swiss Confederation) or in the context of the use of third-party services or disclosure or transmission of data to other persons or companies happens, this only happens if it is done to fulfill our (pre) contractual obligations, on the basis of your consent, on the basis of a legal obligation or on the basis of our legitimate interests. Subject to legal or contractual permissions, we process or have the data in a third country only if the legal requirements are met. I.e. processing takes place e.g. on the basis of special guarantees, such as the officially recognized determination of a data protection level corresponding to the EU (e.g. for the USA through the "Privacy Shield") or compliance with officially recognized special contractual obligations.

Data Protection in Applications and in the Application Process

We collect and process the personal data of applicants for the purpose of handling the application process. The processing can also be done electronically. This is especially the case if an applicant sends us the relevant application documents electronically, for example by email or using a web form on the website. If we conclude an employment contract with an applicant, the data transmitted will be stored for the purpose of processing the employment relationship in compliance with the statutory provisions. If we do not conclude an employment contract with the applicant, the application documents will be automatically deleted two months after notification of the rejection decision, provided that deletion does not conflict with any other legitimate interests on our part. Another legitimate interest in this sense is, for example, a burden of proof in proceedings under the General Equal Treatment Act (AGG).

Rights of the Subject Data

You have the right: (1) To request information about your personal data processed by us in accordance with Art. 15 GDPR. In particular, you can obtain information about the processing purposes, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to correction, deletion, restriction of processing or objection, the existence of a The right to lodge a complaint, the origin of your data, if we have not collected it, as well as the existence of automated decision-making including profiling and, if applicable, meaningful information on their details; (2) In accordance with Art. 16 GDPR, to immediately request the correction of incorrect or incomplete personal data stored by us; (3) To request the deletion of your personal data stored by us in accordance with Art. 17 GDPR, unless processing to exercise the right to freedom of expression and information, to fulfill a legal obligation, for reasons of public interest or to assert, exercise or defence of legal claims is necessary; (4) To request the restriction of the processing of your personal data in accordance with Art. 18 GDPR if you dispute the correctness of the data, the processing is unlawful, but you refuse to delete it and we no longer need the data, but you do Need to assert, exercise or defend legal claims or you have objected to processing in accordance with Art. 21 GDPR; (5) in accordance with Art. 20 GDPR, to receive your personal data that you have provided to us in a structured, common and machine-readable format or to request that it be transmitted to another person responsible; (6) to revoke your consent given to us at any time in accordance with Art. 7 Para. 3 GDPR. As a result, we are no longer allowed to continue the data processing based on this consent in the future (7) To complain to a supervisory authority in accordance with Art. 77 GDPR. As a rule, you can contact the supervisory authority of your usual place of residence or work or our office.

Right to Objection

You have the right, for reasons that arise from your particular situation, to object at any time to the processing of your personal data, which is based on Art. 6 Para. 1 lit. e or f DSGVO takes place to object; this also applies to profiling based on these provisions. The person responsible will no longer process the personal data concerning you unless he can prove compelling legitimate reasons for the processing that outweigh your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims. If the personal data concerning you are processed in order to operate direct mail, you have the right to object at any time to the processing of the personal data concerning you for the purpose of such advertising; this also applies to profiling insofar as it is associated with such direct advertising. If you object to processing for direct marketing purposes, the personal data relating to you will no longer be processed for these purposes. In connection with the use of information society services - regardless of Directive 2002/58 / EC - you have the option of exercising your right of objection by means of automated procedures that use technical specifications.

Automated Decision in Individual Cases Including Profiling

You have the right not to be subject to a decision based solely on automated processing - including profiling - which has legal effects on you or which significantly affects you in a similar manner. This does not apply if the decision (1) is necessary for the conclusion or performance of a contract between you and the person responsible, (2) is permissible on the basis of legal provisions of the Union or of the member states to which the person responsible is subject and these legal provisions contain appropriate measures to safeguard your rights and freedoms and your legitimate interests or (3) takes place with your express consent. However, these decisions may not be based on special categories of personal data according to Art. 9 Para. 1 GDPR, unless Art. 9 Para. 2 lit. a or g applies and appropriate measures have been taken to protect your rights and freedoms and your legitimate interests. With regard to the cases mentioned in (1) and (3), the person responsible shall take appropriate measures to safeguard the rights and freedoms as well as your legitimate interests, including at least the right to obtain intervention by a person on the part of the person responsible, to express their own point of view and heard on contesting the decision. As a responsible company, we do not use automatic decision-making or profiling.

Data Security

We use the popular SSL (Secure Socket Layer) method in conjunction with the highest level of encryption supported by your browser when you visit our website. As a rule, this is a 256-bit encryption. If your browser does not support 256-bit encryption, we use 128-bit v3 technology instead. You can tell whether an individual page of our website is transmitted in encrypted form by the closed key or lock symbol in the lower status bar of your browser. We are responsible for monitoring the technical and organizational security measures to protect your data against the control or the control of manipulation, perception or loss, rejection or unauthorized access by third parties. Our security measures become the technological developments.

Current Status and Changes to this Data Protection Declaration

This data protection declaration is currently valid and is dated August 2020. Due to the further development of our website and offers on it or due to changed legal or official requirements, it may be necessary to change this data protection declaration. You can call up and print out the current data protection declaration at any time via this address.