Privacy Policy

We are very pleased that you are interested in our organisation. The protection of your personal data is particularly important to our management. You can use our websites without disclosing any personal data to us. However, if you wish to use more specific services offered by us via our websites, other online presences, applications or social media pages, we may need to process your personal data. If we wish to process data concerning you and cannot rely on any other legal basis, we will always ask for your consent first (e.g. via a cookie banner).

When handling your personal data (such as your name, address, email address or telephone number), we always comply with the applicable data protection laws. This Privacy Policy informs you about the data we process. It also explains the rights you have as a data subject.

We have implemented various technical and organisational measures to protect your data on our websites as effectively as possible. Nevertheless, the Internet always involves risks, and complete protection cannot be guaranteed. For this reason, you may also provide us with your personal data by other means, for example by telephone, if you prefer.

This Privacy Policy is intended not only to fulfil the obligations arising from the GDPR and to comply with the laws of the Member States of the European Union (EU) and the European Economic Area (EEA). It is also intended to comply with legislation such as that of the United Kingdom (UK GDPR), the Swiss Federal Act on Data Protection and the Swiss Data Protection Ordinance (FADP, DPO), the California Consumer Privacy Act (CCPA/CPRA), China’s Personal Information Protection Law (PIPL), the Delaware Personal Data Privacy Act (DPDPA), Tennessee Information Protection Act (TIPA), Minnesota Consumer Data Privacy Act (MCDPA), Iowa Act Relating to Consumer Data Protection (ICDPA), Maryland Online Data Privacy Act (MODPA), Nebraska Data Privacy Act (NDPA), New Hampshire Consumer Data Privacy Law (SB255), New Jersey Data Privacy Law (SB332), South Carolina Consumer Privacy Bill (House Bill 4696), and other global data protection regulations, and shall be interpreted accordingly. The following Privacy Policy shall be interpreted for each country, state or federal state in such a way that the terminology and legal bases used correspond to the terminology and legal bases applicable in the respective country, state or federal state.

For reasons of readability, our websites, publications, communications and this Privacy Policy do not simultaneously use masculine, feminine, diverse and other gender-specific forms (m/f/d/other). All wording used applies equally to all genders.

For suggestions regarding improvements to the wording of this Privacy Policy, or if you require an external Data Protection Officer, please contact the author of the texts: Prof. Dr. h.c. Heiko Jonny Maniero, LL.B., LL.M. mult., M.L.E.

1. Definitions

In our Privacy Policy, we use specific terms derived from various data protection laws. We want our Privacy Policy to be easy to understand and therefore explain these terms in advance.

Where applicable, the following definitions shall be interpreted or extended in accordance with the case law of the General Court of the European Union (General Court), the Court of Justice of the European Union (CJEU), the Swiss Federal Supreme Court, the Supreme Court of the United Kingdom (UKSC), or in accordance with national data protection laws or national case law of a country, state or federal state, including but not limited to California, including judge-made law and common law, where this is necessary for the application of the law in an individual case.

In this Privacy Policy, we use, among others, the following terms:

a) Personal Data

Personal data means any information relating to an identified or identifiable natural person (hereinafter, where applicable, the “data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person, or who must be regarded as such on the basis of national data protection laws or national case law of a country, state or federal state, including judge-made law and common law.

b) Data Subject

A data subject is any identified or identifiable natural person whose personal data is processed by the controller, a processor, an international organisation or another recipient of data, as well as persons who must be regarded as such on the basis of national data protection laws or national case law of a country, state or federal state, including judge-made law and common law.

c) Processing

Processing means any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

d) Restriction of Processing

Restriction of processing means the marking of stored personal data with the aim of limiting its processing in the future.

e) Profiling

Profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

f) Pseudonymisation

Pseudonymisation means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures ensuring that the personal data is not attributed to an identified or identifiable natural person.

g) Controller

Controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of processing personal data. Where the purposes and means of such processing are determined by Union law or Member State law, the controller or the specific criteria for its nomination may be provided for by Union law or Member State law.

h) Processor

Processor means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

i) Recipient

Recipient means a natural or legal person, public authority, agency or other body to which personal data is disclosed, whether or not a third party. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union law or Member State law shall not be regarded as recipients.

j) Third Party

Third party means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process the personal data.

k) Consent

Consent means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which the data subject, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

2. Name and Address of the Controller

The controller within the meaning of the General Data Protection Regulation, other data protection laws applicable in the Member States of the European Union and the European Economic Area, British data protection laws, Swiss data protection laws (FADP, DPO), California data protection laws (CCPA/CPRA), Chinese data protection law (PIPL), as well as international laws and other provisions of a data protection nature, is:

Niels Becker Ferienhäuser
Bauersgasse 11
54647 Dudeldorf
Germany

Tel.: 01714711472
Email: info@living-in-history.de
Website: www.living-in-history.de

3. Collection of General Data and Information

Our websites collect a range of general data and information each time a data subject or an automated system accesses the websites. This general data and information is stored in the log files of the respective server. The data collected may include, among other things: (1) browser types and versions used, (2) the operating system used by the accessing system, (3) the website from which an accessing system reaches our websites (so-called referrer), (4) the sub-pages accessed via an accessing system on our websites, (5) the date and time of access to the website, (6) an Internet Protocol address (IP address), (7) the Internet service provider of the accessing system, and (8) other similar data and information used to prevent risks in the event of attacks on our information technology systems.

When using this general data and information, we do not draw any conclusions about the data subject. Rather, this information is required in order to (1) correctly deliver the content of our websites, (2) optimise the content of our websites and the advertising thereof, (3) ensure the long-term functionality of our information technology systems and website technology, and (4) provide law enforcement authorities with the information necessary for prosecution in the event of a cyberattack. This anonymously collected data and information is therefore evaluated by us statistically and with the aim of increasing data protection and data security within our organisation in order ultimately to ensure an optimal level of protection for the personal data we process. Server log file data is stored separately from any personal data provided by a data subject.

The purpose of the processing is risk prevention and ensuring IT security, as well as the purposes stated above. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is, in particular, the protection of our information technology systems. The log files are deleted once the stated purposes have been achieved.

4. Contact via the Website and Other Data Transfers and Your Consent

Our websites contain information that enables quick electronic contact with our organisation and direct communication with us, including a general electronic mail address (email address) and, where applicable, a telephone number. If a data subject contacts us by email, via a contact form, an input form or by other means, the personal data transmitted by the data subject is automatically stored. Personal data voluntarily transmitted to us by a data subject is processed for the purpose of handling the enquiry or contacting the data subject.

For the transmission, storage and processing of your contact details and enquiries and for contacting you, we obtain your consent pursuant to Art. 6(1)(a) GDPR and Art. 49(1)(a) GDPR as follows:

By transmitting your personal data, you voluntarily consent to the processing of the personal data you enter or transmit for the purpose of handling your enquiry and contacting you. By transmitting your data to us, you also voluntarily give your explicit consent pursuant to Art. 49(1)(a) GDPR to transfers of data to third countries to and by the companies named in this Privacy Policy and for the purposes stated herein, in particular transfers to third countries for which an EU/EEA adequacy decision does or does not exist, as well as to companies or other bodies that are not covered by an existing adequacy decision due to a lack of self-certification or other participation criteria, and in which, or in relation to which, significant risks exist and no appropriate safeguards for the protection of your personal data are available (e.g. due to Section 702 FISA, Executive Order EO12333 and the CLOUD Act in the USA).

When giving your voluntary and explicit consent, you were aware that an adequate level of data protection may not exist in third countries and that your rights as a data subject may not be enforceable. You may withdraw your consent under data protection law at any time with effect for the future. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

By means of a single action (entry and transmission), you provide several forms of consent. These include consent under EU/EEA data protection law as well as under the CCPA/CPRA, ePrivacy and telemedia law, and other international legal provisions which, among other things, are required as a legal basis for planned further processing of your personal data. By taking this action, you also confirm that you have read and acknowledged this Privacy Policy.

5. Routine Erasure and Restriction of Personal Data

We process and store personal data for the period necessary to achieve the purpose of the processing, or where this is provided for by the European legislator or another legislator in laws or regulations to which we are subject, or for as long as a legal basis for the processing exists.

If the purpose of the processing ceases to apply, a storage period prescribed by the European legislator or another competent legislator expires, or the legal basis for processing ceases to exist, the personal data is routinely restricted or erased in accordance with the applicable statutory provisions.

6. Rights of the Data Subject under the GDPR

a) Right to Confirmation

Every data subject has the right to obtain confirmation from the controller as to whether or not personal data concerning him or her is being processed.

If a data subject wishes to exercise this right, he or she may contact us at any time.

b) Right of Access

Every data subject has the right to obtain from the controller, free of charge and at any time, information about the personal data stored concerning him or her and a copy of that data. Furthermore, the European legislator has granted the data subject access to the following information:

• the purposes of the processing;
• the categories of personal data concerned;
• the recipients or categories of recipients to whom the personal data has been or will be disclosed, in particular recipients in third countries or international organisations;
• where possible, the envisaged period for which the personal data will be stored or, if this is not possible, the criteria used to determine that period;
• the existence of the right to request rectification or erasure of personal data concerning the data subject, or restriction of processing by the controller, or the right to object to such processing;
• the existence of the right to lodge a complaint with a supervisory authority;
• where the personal data is not collected from the data subject, any available information as to its source;
• the existence of automated decision-making, including profiling, referred to in Art. 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject.

Furthermore, the data subject has the right to obtain information as to whether personal data has been transferred to a third country or an international organisation. Where this is the case, the data subject also has the right to be informed of the appropriate safeguards relating to the transfer.

If a data subject wishes to exercise this right, he or she may contact us at any time.

c) Right to Rectification

Every data subject has the right to obtain without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject also has the right to have incomplete personal data completed, including by means of providing a supplementary statement.

If a data subject wishes to exercise this right, he or she may contact us at any time.

d) Right to Erasure (Right to Be Forgotten)

Every data subject has the right to obtain from the controller the erasure of personal data concerning him or her without undue delay where one of the following grounds applies and insofar as processing is not necessary:

• The personal data was collected or otherwise processed for purposes for which it is no longer necessary.
• The data subject withdraws the consent on which the processing is based pursuant to Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR, and there is no other legal ground for the processing.
• The data subject objects to the processing pursuant to Art. 21(1) GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Art. 21(2) GDPR.
• The personal data has been unlawfully processed.
• The personal data must be erased in order to comply with a legal obligation under Union or Member State law to which the controller is subject.
• The personal data has been collected in relation to the offer of information society services referred to in Art. 8(1) GDPR.

Where one of the above grounds applies and a data subject wishes to request the erasure of personal data stored by us, he or she may contact us at any time.

Where personal data has been made public by us and our organisation, as controller, is obliged pursuant to Art. 17(1) GDPR to erase the personal data, we shall, taking account of available technology and the cost of implementation, take reasonable steps, including technical measures, to inform other controllers processing the published personal data that the data subject has requested the erasure by such controllers of any links to, or copies or replications of, that personal data, insofar as processing is not required.

e) Right to Restriction of Processing

Every data subject has the right to obtain from the controller restriction of processing where one of the following conditions applies:

• The accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data.
• The processing is unlawful and the data subject opposes the erasure of the personal data and requests instead the restriction of its use.
• The controller no longer needs the personal data for the purposes of processing, but the data subject requires it for the establishment, exercise or defence of legal claims.
• The data subject has objected to processing pursuant to Art. 21(1) GDPR and it has not yet been determined whether the legitimate grounds of the controller override those of the data subject.

Where one of the above conditions applies and a data subject wishes to request the restriction of personal data stored by us, he or she may contact us at any time.

f) Right to Data Portability

Every data subject has the right to receive the personal data concerning him or her, which the data subject has provided to a controller, in a structured, commonly used and machine-readable format. The data subject also has the right to transmit that data to another controller without hindrance from the controller to which the personal data was provided, where the processing is based on consent pursuant to Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR or on a contract pursuant to Art. 6(1)(b) GDPR and the processing is carried out by automated means, provided that the processing is not necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Furthermore, in exercising the right to data portability pursuant to Art. 20(1) GDPR, the data subject has the right to have personal data transmitted directly from one controller to another, where technically feasible and provided that doing so does not adversely affect the rights and freedoms of others.

If a data subject wishes to exercise this right, he or she may contact us at any time.

g) Right to Object

Every data subject has the right, on grounds relating to his or her particular situation, to object at any time to the processing of personal data concerning him or her based on Art. 6(1)(e) or (f) GDPR. This also applies to profiling based on those provisions.

In the event of an objection, we shall no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing serves the establishment, exercise or defence of legal claims.

Where we process personal data for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data for such marketing. This also applies to profiling to the extent that it is related to such direct marketing. If the data subject objects to our processing for direct marketing purposes, we shall no longer process the personal data for such purposes.

In addition, the data subject has the right, on grounds relating to his or her particular situation, to object to processing of personal data concerning him or her carried out by us for scientific or historical research purposes or statistical purposes pursuant to Art. 89(1) GDPR, unless such processing is necessary for the performance of a task carried out for reasons of public interest.

If a data subject wishes to exercise this right, he or she may contact us at any time. Furthermore, in connection with the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject is free to exercise the right to object by automated means using technical specifications.

h) Automated Individual Decision-Making, Including Profiling

Every data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her, unless the decision (1) is necessary for entering into or performance of a contract between the data subject and the controller, (2) is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject’s rights, freedoms and legitimate interests, or (3) is based on the data subject’s explicit consent.

Where the decision (1) is necessary for entering into or performance of a contract between the data subject and the controller, or (2) is based on the data subject’s explicit consent, we shall implement suitable measures to safeguard the data subject’s rights, freedoms and legitimate interests, including at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.

If a data subject wishes to exercise this right, he or she may contact us at any time.

i) Right to Withdraw Consent under Data Protection Law

Every data subject has the right to withdraw consent to the processing of personal data at any time.

If a data subject wishes to exercise this right, he or she may contact us at any time.

7. General Purpose of Processing, Categories of Data Processed and Categories of Recipients

The general purpose of processing personal data is the handling of all matters concerning the controller, customers, prospective customers, business partners or other contractual or pre-contractual relationships between the aforementioned groups (in the broadest sense), or the controller’s legal obligations. This general purpose applies where no more specific purposes have been stated for a particular processing activity.

The categories of personal data processed by us are customer data, prospective customer data, employee data (including applicant data) and supplier data. The categories of recipients of personal data are public authorities, external bodies, internal processing recipients, intra-group processing recipients and other bodies.

A list of our processors and recipients of data in third countries and, where applicable, international organisations is either published on our website or can be requested from us free of charge.

8. Legal Bases for Processing

Art. 6(1)(a) GDPR serves as the legal basis for processing operations for which we obtain consent for a specific processing purpose.

Where processing of personal data is necessary for the performance of a contract to which the data subject is party, as is the case, for example, with processing operations necessary for the delivery of goods or the provision of another service or consideration, processing is based on Art. 6(1)(b) GDPR. The same applies to processing operations necessary for carrying out pre-contractual measures, for example in cases of enquiries concerning our products or services.

Where we are subject to a legal obligation requiring the processing of personal data, for example to comply with tax obligations, processing is based on Art. 6(1)(c) GDPR.

In rare cases, processing of personal data may become necessary in order to protect the vital interests of the data subject or another natural person. This would be the case, for example, if a visitor were injured at our premises and his or her name, age, health insurance details or other vital information had to be disclosed to a doctor, hospital or other third party. Processing would then be based on Art. 6(1)(d) GDPR.

Where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, the legal basis is Art. 6(1)(e) GDPR.

Finally, processing operations may be based on Art. 6(1)(f) GDPR. This legal basis applies to processing operations not covered by any of the aforementioned legal bases where processing is necessary for the purposes of a legitimate interest pursued by our organisation or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject. Such processing operations are permitted in particular because they have been specifically mentioned by the European legislator. In this respect, the legislator considered that a legitimate interest could, for example, be assumed where the data subject is a customer of the controller (Recital 47, sentence 2 GDPR).

9. Legitimate Interests Pursued by the Controller or a Third Party and Direct Marketing

Where the processing of personal data is based on Art. 6(1)(f) GDPR and no more specific legitimate interests are stated, our legitimate interest is the conduct of our business activities for the benefit and well-being of our staff and shareholders.

We may send you direct marketing concerning our own goods or services that are similar to goods or services you have enquired about, commissioned or purchased. You may object to direct marketing at any time (e.g. by email). You will incur no costs other than transmission costs according to the basic rates. The processing of personal data for direct marketing purposes is based on Art. 6(1)(f) GDPR. The legitimate interest is direct marketing.

Our messages and newsletters may also constitute communications for direct marketing purposes within the meaning of Art. 13(2) of EU Directive 2002/58 (Directive on Privacy and Electronic Communications) and the national law resulting from that Directive, provided that we obtained your electronic and other contact information in connection with the sale of a service or product, including the creation of a free user account through which you are permitted, among other things, to access free content on our websites and publications (newsletters, etc.), provided that we use the direct marketing to advertise similar products or services, so that the direct marketing is also permissible without consent (cf. CJEU, judgment of 13 November 2025, Case C-654/23). In such cases, you may object to the use of your contact information at any time free of charge.

10. Period for Which Personal Data Is Stored

The criterion used to determine the duration of storage of personal data is the respective statutory retention period. Where no statutory retention period exists, the contractual or internal retention period shall apply. After expiry of the relevant period, the corresponding data is routinely deleted, provided that it is no longer required for performance of a contract or the initiation of a contract. This applies in particular to all processing operations for which no more specific criteria have been established.

11. Statutory or Contractual Requirements to Provide Personal Data; Necessity for Entering into a Contract; Obligation of the Data Subject to Provide Personal Data; Possible Consequences of Failure to Provide Such Data

We inform you that the provision of personal data may in part be required by law (e.g. tax regulations) or may arise from contractual provisions (e.g. information concerning the contractual partner). In some cases, it may be necessary for a data subject to provide us with personal data in order to enter into a contract, and we must subsequently process that data.

For example, the data subject is obliged to provide us with personal data where our organisation enters into a contract with him or her. Failure to provide the personal data would mean that the contract with the data subject could not be concluded.

Before providing personal data, the data subject must contact us. We shall inform the data subject on a case-by-case basis whether the provision of personal data is required by law or contract or is necessary for entering into a contract, whether there is an obligation to provide the personal data, and what consequences failure to provide the personal data would have.

12. Existence of Automated Decision-Making

As a responsible organisation, we normally refrain from automated decision-making or profiling. If, in exceptional cases, we carry out automated decision-making or profiling, we will inform the data subject separately or in a subsection of this Privacy Policy (here on our website). In such a case, the following applies:

Automated decision-making, including profiling, may take place where this (1) is necessary for entering into or performance of a contract between the data subject and us, (2) is authorised by Union or Member State law to which we are subject and that law lays down suitable measures to safeguard the data subject’s rights, freedoms and legitimate interests, or (3) is based on the data subject’s explicit consent.

In the cases referred to in Art. 22(2)(a) and (c) GDPR, we implement suitable measures to safeguard the data subject’s rights, freedoms and legitimate interests. In these cases, you have the right to obtain human intervention on the part of the controller, to express your point of view and to contest the decision.

Meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject, will, where applicable, be set out in this Privacy Policy.

13. Recipients in a Third Country, Appropriate or Suitable Safeguards, and How to Obtain a Copy or Where They Are Available

Pursuant to Art. 46(1) GDPR, a controller or processor may transfer personal data to a third country only where the controller or processor has provided appropriate safeguards and provided that enforceable data subject rights and effective legal remedies are available. Appropriate safeguards may, without requiring specific authorisation from a supervisory authority, be provided through standard data protection clauses pursuant to Art. 46(2)(c) GDPR.

Before the first transfer of personal data, EU Standard Contractual Clauses or other appropriate safeguards are agreed with all recipients in third countries, or the transfers are based on adequacy decisions. It is therefore ensured that appropriate safeguards, enforceable rights and effective legal remedies are provided for all processing of personal data. Every data subject may obtain a copy of the Standard Contractual Clauses or adequacy decisions from us. In addition, the Standard Contractual Clauses and adequacy decisions are available in the Official Journal of the European Union.

Art. 45(3) GDPR empowers the European Commission, by means of an implementing act, to decide that a non-EU country ensures an adequate level of protection. This means a level of protection for personal data that is essentially equivalent to the level of protection within the EU. Adequacy decisions mean that personal data may flow without further obstacles from the EU (as well as Norway, Liechtenstein and Iceland) to a third country. Similar provisions apply to the United Kingdom, Switzerland and certain other countries.

In all cases where the European Commission, or a government or competent authority of another country, has decided that a third country ensures an adequate level of protection and/or a valid framework exists (e.g. EU-U.S. Data Privacy Framework, Swiss-U.S. Data Privacy Framework, UK Extension to the EU-U.S. Data Privacy Framework), all transfers by us to members of such frameworks (e.g. self-certified entities) are based exclusively on that entity’s participation in the respective framework or on the respective adequacy decisions.

If we or one of our group companies is a member of such a framework, all transfers to us or our group company are based exclusively on the respective company’s participation in that framework. If we or one of our group companies is established in a third country with an adequate level of protection, all transfers to us or our group company are based exclusively on the respective adequacy decisions.

Every data subject may obtain a copy of the frameworks from us. The frameworks are also available in the Official Journal of the European Union, in published legislative materials, or on the websites of data protection supervisory authorities or other authorities or institutions.

14. Right to Lodge a Complaint with a Data Protection Supervisory Authority

As controller, we are obliged to inform the data subject of the existence of a right to lodge a complaint with a supervisory authority.

The right to lodge a complaint is governed by Art. 77(1) GDPR. Under this provision, without prejudice to any other administrative or judicial remedy, every data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement, if the data subject considers that the processing of personal data relating to him or her infringes the General Data Protection Regulation.

The right to lodge a complaint has been restricted by the Union legislator only to the extent that it may be exercised with only one supervisory authority (Recital 141, sentence 1 GDPR). This provision is intended to prevent duplicate complaints concerning the same matter by the same data subject. If a data subject wishes to lodge a complaint concerning us, we therefore ask that only one supervisory authority be contacted.

15. Data Protection Provisions Regarding the Use of GDPR/CCPA Cookie Consent Banner

GDPR/CCPA Cookie Consent Banner is a WordPress plugin that helps website operators comply with the European Union’s General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). The plugin makes it possible to set up a cookie notice banner that informs visitors about the use of cookies on the website and obtains their consent before cookies are set.

The application is installed on our own IT infrastructure. We are the operator of the service.

Purposes for which personal data is intended to be processed and the legal basis for processing: The purpose of using GDPR/CCPA Cookie Consent Banner is to give users the opportunity to transparently manage their consent to the use of cookies. Processing is based on Art. 6(1)(c) GDPR, as processing is necessary for compliance with a legal obligation to which the controller is subject.

The criteria used to determine the period for which personal data is processed are the statutory or contractual retention periods. The use of personal data is required by law because it is necessary to comply with legal obligations in the field of data protection and consent management. Users are required to specify their cookie preferences or reject cookies, and this information must be stored in order to properly document their decision.

Further information about GDPR/CCPA Cookie Consent Banner is available from WordPress.org.

16. Data Protection Provisions Regarding the Use of Firefox

We use the Firefox web browser within our organisation for Internet use and for running certain web applications. Firefox is developed by Mozilla and provides various features for protecting privacy, securely displaying websites and managing Internet data. When Firefox is used, personal data may be processed, particularly where users use synchronised services such as Firefox Sync, add-ons, Pocket or a Mozilla account. Information such as IP addresses, location data, device identifiers used, installed extensions, language settings, bookmarks, websites visited and usage data may be collected and processed.

Where features such as automatic updates, telemetry data transmission or crash reports are enabled, Firefox transmits diagnostic data to Mozilla in order to improve browser stability and security. This does not include website content, but only technical information such as browser configuration, device model, operating system version or error codes. Firefox also provides protective features such as tracking protection and phishing protection, which may in certain cases involve data being transmitted to Mozilla or associated third-party providers. Use of these features is optional and can be adjusted or disabled in the settings.

The operator of the service and therefore the recipient of personal data is:

Mozilla Corporation
149 New Montgomery St, 4th Floor
San Francisco, CA 94105
USA

For data subjects in the EU and EEA, Mozilla Firefox GmbH, GSG-Hof, Building 3, 4th Floor, Schlesische Straße 27, 10997 Berlin, Germany, is the contact within the meaning of Art. 27 GDPR.

Purposes for which personal data is intended to be processed and the legal basis for processing: Processing is carried out for the provision of a secure and efficient web browser, technical optimisation of the user experience, synchronisation of user-specific settings and error analysis. Processing is based on Art. 6(1)(b) GDPR, i.e. for the performance of a contract to which the data subject is party, as well as Art. 6(1)(f) GDPR. The legitimate interest lies in the secure, stable and user-friendly use of web services, the further development of the browser and the protection of the system environment against potential security risks.

The operator of the service is established in a third country, namely the USA. Transfers to third countries may be based on Standard Contractual Clauses or other appropriate or suitable safeguards referred to in Art. 46(2) GDPR. The operator of the service may have entered into one of the EU standard contracts with us. You may request a copy of the appropriate or suitable safeguards from us.

The criteria used to determine the period for which personal data is processed are the contractual relationship between us and the operator of the service or statutory or contractual retention periods. The provision of personal data is neither required by law or contract nor necessary for entering into a contract. You are not obliged to provide personal data to us or the operator of the service. However, if you do not provide such data, our services or those of the service operator may not be available.

Further information and Mozilla Firefox’s applicable privacy provisions are available at https://www.mozilla.org/.

17. Data Protection Provisions Regarding the Use of Google Chrome

We use the Google Chrome web browser for the use of web-based applications, display of Internet content and integration of browser-based business services. Google Chrome is provided by Google and offers numerous functions, including synchronisation via Google accounts, integration with other Google services, automated form completion, voice control, and the use of extensions and security technologies.

When Google Chrome is used, personal data may be processed, particularly where the browser is linked to a Google account or users voluntarily activate synchronisation services and extensions. The data processed includes IP addresses, search queries, browsing history, installed extensions, location data, language settings and technical device information.

Where the user is signed in to a Google account, Chrome activities such as browsing history, bookmarks, passwords and other browser settings may be synchronised across devices and stored on Google servers. Chrome also collects diagnostic data and usage statistics to improve browser stability, security and performance where this feature is enabled. When forms are automatically completed (e.g. addresses or credit card information), personal information is also processed locally or on servers. Chrome may also use third-party tools such as Safe Browsing or translation services, which may likewise trigger data processing operations.

The operator of the service and therefore the recipient of personal data is:

Google LLC
1600 Amphitheatre Parkway
Mountain View, CA 94043
USA

For data subjects in the EU and EEA, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, acts as contact and representative within the meaning of Art. 27 GDPR.

The representative under national law in the United Kingdom is:

Google UK Limited
Belgrave House
76 Buckingham Palace Road
London SW1W 9TQ
United Kingdom

The representative pursuant to Art. 14 of the Swiss Federal Act on Data Protection (FADP) is:

Google Switzerland GmbH
Brandschenkestrasse 110
8002 Zurich
Switzerland

Purposes for which personal data is intended to be processed and the legal basis for processing: Processing serves the secure, stable and personalised use of the web browser, synchronisation of user preferences, improvement of browser performance, protection against harmful content, and integration with other Google services. Processing is based on Art. 6(1)(b) GDPR, i.e. for performance of a contract to which the data subject is party, and Art. 6(1)(f) GDPR. The legitimate interest lies in the secure provision of Internet functions, technical stability, user-friendliness and integration of services to optimise the online experience.

The operator of the service is established in a third country, namely the USA. Transfers to third countries may be based on Standard Contractual Clauses or other appropriate or suitable safeguards referred to in Art. 46(2) GDPR. The operator of the service may be a certified participant in one or more of the Data Privacy Frameworks. Further details are available at https://www.dataprivacyframework.gov/list. You may request a copy of the appropriate or suitable safeguards from us.

Further information and Google Chrome’s applicable privacy provisions are available at https://policies.google.com/privacy.

18. Data Protection Provisions Regarding the Use of MySQL

We use MySQL as a relational database management system for the structured storage, organisation and processing of data within our web applications and IT systems. MySQL enables us to efficiently manage personal data by providing the basis for dynamic website functions, user accounts, form processing, database queries and back-end processes.

During operation, personal data may be processed, particularly where users complete forms, register or log in, place orders or interact with database-supported functions. In these cases, information such as names, email addresses, login details, IP addresses, times of use or submitted content is stored within MySQL.

MySQL itself is not directly responsible for the processing, but provides the infrastructure on which we, as controller, store and retrieve data. The actual processing is performed by our systems, while MySQL is operated as a software solution on our own servers or within hosting services. The application itself does not contain integrated analytics or tracking functions. Access to the database is protected by authentication mechanisms, access restrictions and encryption technologies to prevent unauthorised access.

The application is installed on our own IT infrastructure or in our hosting environment. We are the operator of the service.

Purposes for which personal data is intended to be processed and the legal basis for processing: The purpose of processing is the systematic management, storage and protection of user data and the provision of dynamic functions within our web services. Processing is based on Art. 6(1)(b) GDPR for performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract, as well as Art. 6(1)(f) GDPR. Our legitimate interest lies in reliable, secure and efficient data storage in the course of our business operations.

The criteria used to determine the period for which personal data is processed are statutory or contractual retention periods. The provision of personal data is neither required by law or contract nor necessary for entering into a contract. You are not obliged to provide us with personal data. However, if such data is not provided, our services may not be available.

Further information and MySQL’s applicable privacy provisions are available at https://www.mysql.com.

19. Data Protection Provisions Regarding the Use of WhatsApp

WhatsApp LLC provides a widely used instant messaging service that enables users to send and receive text messages, voice messages, images, videos and documents. Users can also make voice and video calls. WhatsApp uses end-to-end encryption designed to ensure the security and privacy of communications between users.

When WhatsApp is used, personal data such as telephone numbers, profile names, profile pictures, online status information and location data is processed. Information concerning interactions between users, such as messages and call data, is also transmitted in encrypted form and may be used by WhatsApp to improve the service and ensure security.

The operator of the service and therefore the recipient of personal data is:

WhatsApp Ireland Limited
Merrion Road
Dublin 4, D04 X2K5
Ireland

The representative under national law in the United Kingdom is:

WhatsApp Ltd.
57 Garth Road
London, England, NW2 2NH
United Kingdom

Purposes for which personal data is intended to be processed and the legal basis for processing: The purpose of data processing is the use of the messaging service and its associated functions. Processing is based on performance of a contract pursuant to Art. 6(1)(b) GDPR, to which the data subject is party, as well as legitimate interests pursuant to Art. 6(1)(f) GDPR, such as the use of an efficient platform, improvement of our services, and ensuring the security of users and their data.

The criteria used to determine the period for which personal data is processed are the contractual relationship between us and the operator of the service or statutory or contractual retention periods. The provision of personal data is neither required by law or contract nor necessary for entering into a contract. You are not obliged to provide personal data to us or the operator of the service. However, if such data is not provided, our services or those of the service operator may not be available.

Further information and WhatsApp’s applicable privacy provisions are available at https://www.whatsapp.com.

20. Data Protection Provisions Regarding the Use of STRATO

STRATO is a provider of web hosting services, domain registrations, cloud storage, online shops and other Internet-based services. With an extensive portfolio of products, STRATO supports both private individuals and businesses in effectively creating and managing their online presence. STRATO’s services are designed to provide users with reliable, secure and user-friendly solutions for their web projects.

When STRATO services are used, personal data such as names, addresses, email addresses, telephone numbers, payment information and usage data relating to the services offered is processed. This information is necessary to provide the services, manage user accounts, handle support requests and ensure the security of user data.

The operator of the service and therefore the recipient of personal data is:

STRATO GmbH
Otto-Ostrowski-Straße 7
10249 Berlin
Germany

Purposes for which personal data is intended to be processed and the legal basis for processing: The purpose of data processing is the use of web hosting services and the other products offered. Processing is based on performance of a contract pursuant to Art. 6(1)(b) GDPR, to which the data subject is party, as well as legitimate interests pursuant to Art. 6(1)(f) GDPR, such as improving our services, ensuring network and information security, and using external hosting.

The criteria used to determine the period for which personal data is processed are the contractual relationship between us and the operator of the service or statutory or contractual retention periods. The provision of personal data is neither required by law or contract nor necessary for entering into a contract. You are not obliged to provide personal data to us or the operator of the service. However, if such data is not provided, our services or those of the service operator may not be available.

Further information and STRATO’s applicable privacy provisions are available at https://www.strato.de.

21. Data Protection Provisions Regarding the Use of Adobe Fonts

Adobe Fonts is a service provided by Adobe that gives web developers and designers access to an extensive library of high-quality fonts in order to improve the design and aesthetics of digital content. By integrating Adobe Fonts into our website, we can ensure that text is displayed consistently and aesthetically, regardless of the user’s device or browser. Adobe Fonts uses technologies such as stylesheets and font files that are loaded from Adobe servers when our website is visited.

Information such as the user’s IP address, the page of our website visited, and the date and time of access may be collected. This data is required to provide the fonts and optimise the delivery services.

The operator of the service and therefore the recipient of personal data is:

Adobe Systems, Inc.
345 Park Avenue
San Jose, CA 95110-2704
USA

For data subjects in the EU and EEA, Adobe Systems Software Ireland Limited, 4-6 Riverwalk, Citywest Business Campus, Dublin 24, Ireland, acts as contact and representative within the meaning of Art. 27 GDPR.

The representative under national law in the United Kingdom is:

Adobe Systems Europe Ltd.
C/O Brodies LLP
Capital Square
58 Morrison Street
Edinburgh, EH3 8BP
United Kingdom

The representative pursuant to Art. 14 of the Swiss Federal Act on Data Protection (FADP) is:

Adobe Systems (Schweiz) GmbH
c/o World Trade Center
Leutschenbachstrasse 95
8050 Zurich
Switzerland

Purposes for which personal data is intended to be processed and the legal basis for processing: The purpose of using Adobe Fonts is to visually optimise our website by providing high-quality fonts. Processing is based on Art. 6(1)(f) GDPR, with the legitimate interest consisting of the consistent and attractive presentation of our digital content.

The operator of the service is established in a third country, namely the USA. Transfers to third countries may be based on Standard Contractual Clauses or other appropriate or suitable safeguards referred to in Art. 46(2) GDPR. The operator of the service may be a certified participant in one or more of the Data Privacy Frameworks. Further details are available at https://www.dataprivacyframework.gov/list. You may request a copy of the appropriate or suitable safeguards from us.

The criteria used to determine the period for which personal data is processed are the contractual relationship between us and the operator of the service or statutory or contractual retention periods. The provision of personal data is neither required by law or contract nor necessary for entering into a contract. You are not obliged to provide personal data to us or the operator of the service. However, if such data is not provided, our services or those of the service operator may not be available.

Further information and Adobe Fonts’ applicable privacy provisions are available at https://www.adobe.com.

22. Data Protection Provisions Regarding the Use of Google Fonts

Google Fonts is a free service provided by Google LLC that offers web developers a wide range of fonts to improve the design and aesthetics of websites. By integrating Google Fonts, web developers can ensure that text on their websites is displayed consistently and as intended across different devices and browsers. Google Fonts is delivered via Google servers, ensuring high availability and fast loading times.

When Google Fonts is used, personal data such as IP addresses and browser information may be processed because a request is sent to Google servers when the fonts are loaded. This data is used to provide the service, optimise performance and prevent misuse.

The operator of the service and therefore the recipient of personal data is:

Google LLC
1600 Amphitheatre Parkway
Mountain View, CA 94043
USA

For data subjects in the EU and EEA, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, acts as contact and representative within the meaning of Art. 27 GDPR.

The representative under national law in the United Kingdom is:

Google UK Limited
Belgrave House
76 Buckingham Palace Road
London SW1W 9TQ
United Kingdom

The representative pursuant to Art. 14 of the Swiss Federal Act on Data Protection (FADP) is:

Google Switzerland GmbH
Brandschenkestrasse 110
8002 Zurich
Switzerland

Purposes for which personal data is intended to be processed and the legal basis for processing: The purpose of processing is the use and optimisation of the font service for web developers and end users. Processing is based on Art. 6(1)(f) GDPR, with the legitimate interest consisting of improving the user experience on websites by providing a variety of fonts and ensuring fast loading times.

The operator of the service is established in a third country, namely the USA. Transfers to third countries may be based on Standard Contractual Clauses or other appropriate or suitable safeguards referred to in Art. 46(2) GDPR. The operator of the service may be a certified participant in one or more of the Data Privacy Frameworks. Further details are available at https://www.dataprivacyframework.gov/list. You may request a copy of the appropriate or suitable safeguards from us.

The criteria used to determine the period for which personal data is processed are the contractual relationship between us and the operator of the service or statutory or contractual retention periods. The provision of personal data is neither required by law or contract nor necessary for entering into a contract. You are not obliged to provide personal data to us or the operator of the service. However, if such data is not provided, our services or those of the service operator may not be available.

Further information and Google Fonts’ applicable privacy provisions are available at https://policies.google.com/privacy.

23. Data Protection Provisions Regarding the Use of Google Maps

Google Maps is a comprehensive mapping and navigation service provided by Google LLC that enables users to view maps, plan routes and find local businesses and services. By providing detailed geographical information, Google Maps helps people around the world with everyday orientation and navigation. The service offers functions such as satellite imagery, street views, real-time traffic conditions and the ability to rate and review places.

When Google Maps is used, personal data such as location data, search queries and usage statistics is processed. This information is necessary to provide and use the service, offer personalised recommendations and improve the user experience.

The operator of the service and therefore the recipient of personal data is:

Google LLC
1600 Amphitheatre Parkway
Mountain View, CA 94043
USA

For data subjects in the EU and EEA, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, acts as contact and representative within the meaning of Art. 27 GDPR.

The representative under national law in the United Kingdom is:

Google UK Limited
Belgrave House
76 Buckingham Palace Road
London SW1W 9TQ
United Kingdom

The representative pursuant to Art. 14 of the Swiss Federal Act on Data Protection (FADP) is:

Google Switzerland GmbH
Brandschenkestrasse 110
8002 Zurich
Switzerland

Purposes for which personal data is intended to be processed and the legal basis for processing: The purpose of processing is the use and optimisation of the mapping and navigation service. Processing is based on Art. 6(1)(f) GDPR, with the legitimate interest consisting of providing and using an efficient, user-friendly and precise navigation service.

The operator of the service is established in a third country, namely the USA. Transfers to third countries may be based on Standard Contractual Clauses or other appropriate or suitable safeguards referred to in Art. 46(2) GDPR. The operator of the service may be a certified participant in one or more of the Data Privacy Frameworks. Further details are available at https://www.dataprivacyframework.gov/list. You may request a copy of the appropriate or suitable safeguards from us.

The criteria used to determine the period for which personal data is processed are the contractual relationship between us and the operator of the service or statutory or contractual retention periods. The provision of personal data is neither required by law or contract nor necessary for entering into a contract. You are not obliged to provide personal data to us or the operator of the service. However, if such data is not provided, our services or those of the service operator may not be available.

Further information and Google Maps’ applicable privacy provisions are available at https://policies.google.com/privacy.

24. Data Protection Provisions Regarding the Use of Facebook

Facebook is a social network that enables people to connect online, share content and communicate. Users can create profiles, post photos and videos, exchange messages and organise themselves in groups. Facebook also provides businesses and organisations with a platform for advertising and interacting with their target audiences.

When Facebook is used, personal data such as names, email addresses, telephone numbers, usage data, location information and information relating to shared content is processed. This data is necessary to provide the platform, offer personalised content and advertising, ensure user security and develop new services.

The operator of the service and therefore the recipient of personal data is:

Meta Platforms, Inc.
1 Meta Way
Menlo Park, CA 94025
USA

For data subjects in the EU and EEA, Meta Platforms Ireland Ltd., Merrion Road, Dublin D04 X2K5, Ireland, acts as contact and representative within the meaning of Art. 27 GDPR.

The representative under national law in the United Kingdom is:

Meta Platforms Technologies UK Ltd
10 Brock Street
Regent’s Place
London, NW1 3FG
United Kingdom

Purposes for which personal data is intended to be processed and the legal basis for processing: The purpose of processing is the use and improvement of social networking functions and network services. Processing is based on Art. 6(1)(b) GDPR for performance of a contract to which the data subject is party, as well as Art. 6(1)(f) GDPR, with the legitimate interest consisting of improving the user experience, providing personalised content and advertising, and ensuring network security.

The operator of the service is established in a third country, namely the USA. Transfers to third countries may be based on Standard Contractual Clauses or other appropriate or suitable safeguards referred to in Art. 46(2) GDPR. The operator of the service may be a certified participant in one or more of the Data Privacy Frameworks. Further details are available at https://www.dataprivacyframework.gov/list. You may request a copy of the appropriate or suitable safeguards from us.

The criteria used to determine the period for which personal data is processed are the contractual relationship between us and the operator of the service or statutory or contractual retention periods. The provision of personal data is neither required by law or contract nor necessary for entering into a contract. You are not obliged to provide personal data to us or the operator of the service. However, if such data is not provided, our services or those of the service operator may not be available.

Further information and Facebook’s applicable privacy provisions are available at https://facebook.com.

25. Data Protection Provisions Regarding the Use of Instagram

Instagram is a widely used social network that enables users to share photos and videos, publish Stories and interact with followers and friends. Instagram provides a variety of features, including direct messages, IGTV for longer videos, Instagram Live for real-time broadcasts and an Explore page for discovering new content and users.

When Instagram is used, personal data such as names, email addresses, telephone numbers, user content (photos, videos, comments, etc.), location data, usage information and, in some cases, payment information is processed. This data helps provide the service, ensure platform security, offer personalised advertising and improve the user experience.

The operator of the service and therefore the recipient of personal data is:

Meta Platforms, Inc.
1 Meta Way
Menlo Park, CA 94025
USA

For data subjects in the EU and EEA, Meta Platforms Ireland Ltd., Merrion Road, Dublin D04 X2K5, Ireland, acts as contact and representative within the meaning of Art. 27 GDPR.

The representative under national law in the United Kingdom is:

Meta Platforms Technologies UK Ltd
10 Brock Street
Regent’s Place
London, NW1 3FG
United Kingdom

Purposes for which personal data is intended to be processed and the legal basis for processing: The purpose of processing is the use and optimisation of social networking functions. Processing is based on Art. 6(1)(b) GDPR for performance of a contract to which the data subject is party, as well as Art. 6(1)(f) GDPR, with the legitimate interest consisting of improving and personalising the user experience, providing customer support, ensuring the security and integrity of the platform, and using the platform for marketing purposes.

The operator of the service is established in a third country, namely the USA. Transfers to third countries may be based on Standard Contractual Clauses or other appropriate or suitable safeguards referred to in Art. 46(2) GDPR. The operator of the service may be a certified participant in one or more of the Data Privacy Frameworks. Further details are available at https://www.dataprivacyframework.gov/list. You may request a copy of the appropriate or suitable safeguards from us.

The criteria used to determine the period for which personal data is processed are the contractual relationship between us and the operator of the service or statutory or contractual retention periods. The provision of personal data is neither required by law or contract nor necessary for entering into a contract. You are not obliged to provide personal data to us or the operator of the service. However, if such data is not provided, our services or those of the service operator may not be available.

Further information and Instagram’s applicable privacy provisions are available at https://instagram.com.

26. Data Protection Provisions Regarding the Use of YouTube

YouTube is a platform for sharing and viewing videos used by individuals, artists, businesses and media organisations to publish a wide variety of content such as music videos, vlogs, educational material and much more. YouTube enables users to upload, share and comment on videos and to interact with a broad community.

When YouTube is used, personal data such as IP addresses, user interactions (e.g. videos viewed and comments), location data (where enabled for services), and information from linked Google accounts is processed. This information is necessary to provide personalised content and advertising, enable user interactions, maintain platform security and improve the user experience.

The operator of the service and therefore the recipient of personal data is:

Google LLC
1600 Amphitheatre Parkway
Mountain View, CA 94043
USA

For data subjects in the EU and EEA, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, acts as contact and representative within the meaning of Art. 27 GDPR.

The representative under national law in the United Kingdom is:

Google UK Limited
Belgrave House
76 Buckingham Palace Road
London SW1W 9TQ
United Kingdom

The representative pursuant to Art. 14 of the Swiss Federal Act on Data Protection (FADP) is:

Google Switzerland GmbH
Brandschenkestrasse 110
8002 Zurich
Switzerland

Purposes for which personal data is intended to be processed and the legal basis for processing: The purpose of data processing is the use of video-sharing services. Processing is based on performance of a contract pursuant to Art. 6(1)(b) GDPR, to which the data subject is party, as well as legitimate interests pursuant to Art. 6(1)(f) GDPR, such as the use of an efficient video platform, improvement of the user experience, use of personalised advertising, and use of embedded videos on our website.

The operator of the service is established in a third country, namely the USA. Transfers to third countries may be based on Standard Contractual Clauses or other appropriate or suitable safeguards referred to in Art. 46(2) GDPR. The operator of the service may be a certified participant in one or more of the Data Privacy Frameworks. Further details are available at https://www.dataprivacyframework.gov/list. You may request a copy of the appropriate or suitable safeguards from us.

The criteria used to determine the period for which personal data is processed are the contractual relationship between us and the operator of the service or statutory or contractual retention periods. The provision of personal data is neither required by law or contract nor necessary for entering into a contract. You are not obliged to provide personal data to us or the operator of the service. However, if such data is not provided, our services or those of the service operator may not be available.

Further information and YouTube’s applicable privacy provisions are available at https://policies.google.com.

This Privacy Policy was created using a generator developed with the support of experts in competition law, external data protection consultancy and an accredited certification body.

Legal Notice / Imprint

LIVING IN hISTORY
Niels Becker Ferienhäuser
Bauersgasse 11
D-54657 Dudeldorf
Germany