Privacy Policy

We take the protection of your personal data very seriously and would like to inform you below about the nature, scope and purpose of the personal data we process.

If you provide us with personal data on a voluntary basis, e.g. by email, it is processed in accordance with, in particular, the requirements of the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

We have implemented technical and organizational measures to ensure the most complete protection possible of the personal data processed via our website. Please note, however, that data transmissions over the Internet may always have security gaps over which we have no influence, and absolute protection, particularly in email communication, therefore cannot be guaranteed.

Name and contact details of the controller

This privacy information applies to data processing by:

Zinkler & Brandes GmbH Am Neuen Werk 3 33378 Rheda-Wiedenbrück Germany

Represented by the managing directors:

Björn Zinkler

Tim Brandes

Contact

Phone: +49 5242 18266-0

Email: team@zinklerbrandes.com

Data security

During your visit to our website, we use the widespread SSL (Secure Socket Layer) protocol in conjunction with the highest level of encryption supported by your browser. As a rule, this is 256-bit encryption. You can tell whether an individual page of our website is transmitted in encrypted form by the closed key or padlock symbol in the status bar of your browser. In addition, we use appropriate technical and organizational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction or unauthorized access by third parties. Our security measures are continuously improved in line with technological developments.

Personal data

Pursuant to Art. 4(1) GDPR, personal data means any information relating to an identified or identifiable natural person ("data subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Personal data is therefore any data that can be related to you personally, e.g. name, address, email address, telephone number or IP address.

Collection and storage of personal data and the nature and purpose of its use

1. Visiting our website

When you access our website, the browser used on your device automatically sends information to the server of our website. This information is temporarily stored in a so-called log file. The following information is collected without any action on your part and stored until it is automatically deleted:

• IP address of the requesting computer,
• date and time of access,
• name and URL of the retrieved file,
• website from which access is made (referrer URL),
• the browser used and, where applicable, the operating system of your computer and the name of your access provider.

We process the above data for the following purposes:

• ensuring a smooth connection to the website,
• ensuring convenient use of our website,
• evaluating system security and stability, and
• for other administrative purposes.

The legal basis for the data processing is Art. 6(1) sentence 1 lit. f GDPR. Our legitimate interest follows from the purposes of data collection listed above. Under no circumstances do we use the collected data for the purpose of drawing conclusions about your person.

In addition, we use cookies and third-party tools when you visit our website. You will find more detailed explanations further below in this privacy policy.

2. Contact form / sending an email

For questions of any kind, we offer you the opportunity to contact us, e.g. via a form on our website or by email. When using the contact form, a valid email address and your name are required so that we know who sent the inquiry and can respond to it. Data processing for the purpose of contacting us is carried out pursuant to Art. 6(1) sentence 1 lit. a GDPR on the basis of your voluntarily given consent. We store and use your information exclusively to handle your inquiry. The personal data you voluntarily send us will be blocked or deleted once your inquiry has been dealt with. Data is blocked if your inquiry has been conclusively dealt with and statutory retention obligations exist. If your contact is aimed at the conclusion of a contract, an additional legal basis for the processing is Art. 6(1) lit. b GDPR (performance of contractual relationships).

Disclosure of data

Your personal data will not be transferred to third parties for purposes other than those listed below. We only disclose your personal data to third parties if:

• you have given your express consent to this pursuant to Art. 6(1) sentence 1 lit. a GDPR,
• this is necessary pursuant to Art. 6(1) sentence 1 lit. b GDPR for the performance of contractual relationships with you.
• in the event that there is a legal obligation for the disclosure pursuant to Art. 6(1) sentence 1 lit. c GDPR, and
• the disclosure is necessary pursuant to Art. 6(1) sentence 1 lit. f GDPR and there is no reason to assume that you have an overriding legitimate interest in your data not being disclosed.

Partner advertising

Providers of viewing offers can unlock additional offers free of charge via partners (a partner's promo code or the "Partner offer" option, free of charge thanks to a partner). In connection with these offers, we display partner advertising labeled as an "Ad": on our platform (e.g. in the offer view or on the confirmation page for prospective viewers after a booking), in documents (e.g. the appointment list as a PDF) and in email notifications to the provider about these offers. Prospective viewers see the advertising only on our websites, not in emails. The advertising is not personalized; it is selected only by language, property type of the offer and whether the provider came to us through the partner's campaign.

For this purpose, we store via which partner an offer was unlocked, as well as the time and text version of the provider's consent. The legal basis is the agreement on free unlocking (Art. 6(1) sentence 1 lit. b GDPR); for advertising in emails, the provider's consent (Art. 6(1) sentence 1 lit. a GDPR, § 7(2) UWG (German Act Against Unfair Competition)). The provider may object to advertising in emails at any time via the link in every email or in their offer view. Prospective viewers do not receive advertising by email.

In order to bill the advertising with our partners, we count impressions and clicks per ad, ad space, property type and day. We do not use cookies or store IP addresses for this; automated access (bots) is not counted. The legal basis is our legitimate interest in billing and proving the advertising performance (Art. 6(1) sentence 1 lit. f GDPR).

A click on an ad leads to the partner's website. In doing so, we pass on a randomly generated click ID that allows the partner to recognize that the visit came from our platform; it contains no information about your person. The partner is responsible for the processing on its website.

Our partners receive from us only aggregated figures (e.g. number of offers enabled, impressions and clicks per property type, locations only once there are several offers), no personal data, no offer names and no addresses.

Cookies

We use cookies on our website. These are small files that your browser automatically creates and that are stored on your device (laptop, tablet, smartphone or similar) when you visit our website. Cookies do not cause any damage to your device and do not contain viruses, Trojans or other malware. The cookie stores information that arises in each case in connection with the specific device used. However, this does not mean that we thereby obtain direct knowledge of your identity. The use of cookies serves to make the use of our services more pleasant for you.

We only use so-called session cookies to recognize that you have already visited individual pages of our website. These are automatically deleted after you leave our website.

In addition, to optimize user-friendliness, we also use temporary cookies that are stored on your device for a specific, fixed period (up to two years). If you visit our website again to use our services, it is automatically recognized that you have already been with us and, for example, which entries and settings you have made, so that you do not have to enter them again.

We also use cookies to statistically record the use of our website and to evaluate it for the purpose of optimizing our services for you (see below). These cookies are also automatically deleted after a defined period (up to two years).

The data processed by cookies is necessary for the purposes mentioned to safeguard our legitimate interests and those of third parties pursuant to Art. 6(1) sentence 1 lit. f GDPR. Most browsers accept cookies automatically. However, you can configure your browser so that no cookies are stored on your computer or a notice always appears before a new cookie is created. However, completely disabling cookies may mean that you cannot use all the functions of our website.

Third-party tools

The third-party tools we use as described below are used on the basis of Art. 6(1) sentence 1 lit. f GDPR. With these tools and the associated statistical recording and evaluation of the use of our website, we aim to ensure a needs-based design and continuous optimization of our website.

1. Vimeo

Our website integrates plugins of the video portal Vimeo, operated by Vimeo, LLC, 555 West 18th Street, New York, New York 10011, USA. Each time a page offering one or more Vimeo video clips is accessed, a direct connection is established between your browser and a Vimeo server in the USA. Information about your visit and your IP address is stored there. Through interactions with the Vimeo plugins (e.g. clicking the start button), this information is also transmitted to Vimeo and stored there. Vimeo's privacy policy, with more detailed information on the collection and use of your data by Vimeo, can be found in Vimeo's privacy policy: https://vimeo.com/privacy.

If you have a Vimeo user account and do not want Vimeo to collect data about you via this website and link it to your membership data stored with Vimeo, you must log out of Vimeo before visiting this website.

In addition, Vimeo calls up the Google Analytics tracker via an iFrame in which the video is loaded. This is Vimeo's own tracking, to which we have no access. You can prevent tracking by Google Analytics by using the deactivation tools that Google offers for some Internet browsers. You can also prevent the collection of data generated by Google Analytics and relating to your use of the website (including your IP address) by Google, as well as the processing of this data by Google, by downloading and installing the browser plugin available at the following link:

http://tools.google.com/dlpage/gaoptout?hl=de

Erasure and blocking of personal data

We process and store personal data only for the period necessary to achieve the purpose of storage (e.g. proper business processing) or as required by a statutory storage/retention period. If the purpose of storage no longer applies or a statutory storage/retention period expires, we delete the personal data. If statutory storage/retention obligations continue to exist, e.g. after proper business processing or conclusive response to your inquiries, we restrict the processing, e.g. by blocking your data. Where mandatory commercial and tax law retention periods must be observed, the storage period for certain data may be up to ten years.

Rights of data subjects

As a data subject, you have the right:

• pursuant to Art. 15 GDPR, to request information about your personal data processed by us. In particular, you may request information about the purposes of processing, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the source of your data if it was not collected by us, and the existence of automated decision-making, including profiling, and, where applicable, meaningful information about its details;
• pursuant to Art. 16 GDPR, to request without undue delay the rectification of inaccurate or the completion of your personal data stored by us;
• pursuant to Art. 17 GDPR, to request the erasure of your personal data stored by us, unless the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defense of legal claims;
• pursuant to Art. 18 GDPR, to request the restriction of processing of your personal data if you contest the accuracy of the data, the processing is unlawful but you oppose its erasure and we no longer need the data, but you require it for the establishment, exercise or defense of legal claims, or you have objected to the processing pursuant to Art. 21 GDPR;
• pursuant to Art. 20 GDPR, to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format or to request its transmission to another controller;
• pursuant to Art. 7(3) GDPR, to withdraw your consent once given at any time vis-à-vis us. As a result, we may no longer continue the data processing based on this consent in the future; and
• pursuant to Art. 77 GDPR, to lodge a complaint with a supervisory authority. As a rule, you can contact the supervisory authority of your habitual residence or place of work or of our registered office for this purpose.

Right to object

If your personal data is processed on the basis of legitimate interests pursuant to Art. 6(1) sentence 1 lit. f GDPR, you have the right, pursuant to Art. 21 GDPR, to object to the processing of your personal data, provided that there are grounds for this arising from your particular situation or the objection is directed against direct marketing. In the latter case, you have a general right to object, which we will implement without you having to specify a particular situation.

If you wish to exercise your right to withdraw consent or your right to object, an email to us is sufficient.

If you exercise your right to object, we will stop processing the data concerned. However, further processing remains reserved if we can demonstrate compelling legitimate grounds for the processing that override your interests and rights, or if the processing serves the establishment, exercise or defense of legal claims.

Validity and amendment of this privacy policy

This privacy policy is currently valid. Due to the further development of our website and the services offered through it, or due to changes in legal or regulatory requirements, it may become necessary to amend this privacy policy. You can access and print out the current privacy policy at any time on our website.