Privacy Policy

1.2 Controller (Article 4(7) of the GDPR)
The controller responsible for the processing of your personal data in connection with the use of the website www.visitmosel.de (hereinafter referred to as the ‘website’) is Mosellandtouristik GmbH (hereinafter referred to as the ‘operator’ or ‘controller’).

Contact details:
Mosellandtouristik GmbH
Kordelweg 1 | 54470 Bernkastel-Kues
Managing Director: Thomas Kalff
Telephone: +49 6531 9733-0
Email: info@mosellandtouristik.de

1.3 Data Protection Officer
You can contact the Data Protection Officer at:

MORGENSTERN consecom GmbH
Johannesstraße 30
67346 Speyer
Telephone: +49 (0) 6232 - 100119 44

1.4 Right to object
If you wish to object to the processing of your data by the operator, either in full or in relation to specific measures, in accordance with this privacy policy, you may do so using the contact details provided above or in the legal notice. Please note that, in the event of such an objection, your use of the website and access to the services offered via it may be restricted or may not be possible at all.

2.1 Accessing and using the website
Each time the website and its subpages are accessed, usage data is transmitted by the relevant web browser and stored in log files (server log files).

The data records stored in this way contain the following information:

• Date and time of access
• Name of the subpage accessed
• IP address
• Referrer URL (the URL from which you accessed the website) Amount of data transferred
• Product and version information for the browser used

The log files are analysed by the operator in anonymised form in order to further improve the website and make it more user-friendly, to identify and rectify errors more quickly, and to manage server capacity. This makes it possible, for example, to determine at what times the website is particularly popular, enabling the operator to provide the necessary data capacity. The data processed by the operator is required by the operator to enable you to access and use the website. This data must necessarily be processed whilst using a digital medium. The lawfulness of this processing is based on Article 6(1)(f) of the GDPR. The operator’s legitimate interest lies in providing a website containing information and offering services to its customers, as well as in optimising the operation of the website. The provision of this data is necessary in order to access the operator’s website. Failure to provide this data means that the website cannot be accessed. Your IP address is deleted or anonymised once you have finished using the website. During anonymisation, IP addresses are modified in such a way that they can no longer be attributed to a specific or identifiable natural person, or can only be attributed to such a person with a disproportionate amount of time, cost and effort.

2.2 Contact form
If you wish to contact the operator, a contact form is available for this purpose. You must provide the following details on this form:

• Email address
• Message

You may also provide the following information on a voluntary basis:

• First name
• Surname
• Street, house number
•  Postcode, town
• Telephone number

The data controller uses your data to respond to your enquiry and to provide you with any information you may have requested. The lawfulness of this processing is based on Article 6(1)(b) of the GDPR, according to which processing is lawful where it is necessary for the performance of a contract to which the data subject is a party, or for the implementation of pre-contractual measures taken at the data subject’s request. Without the data collected from you, the operator cannot respond to your enquiry or get in touch with you. The personal data processed in the course of this communication will be deleted once the statutory retention periods have expired, unless the controller has a legitimate interest in retaining it further. In any case, only those data that are absolutely essential for achieving the relevant purpose will continue to be stored. Where possible, personal data will be anonymised.

2.3 Newsletter
To receive additional information from the operator, you can subscribe to an email newsletter. To do so, you only need to provide your email address. Any further details provided to personalise the newsletter are voluntary. The so-called double opt-in procedure is used to send the newsletter; this means you will only receive a newsletter by email once you have expressly confirmed that you wish to activate the newsletter service. Once you have activated the newsletter, you will receive a confirmation email containing an activation link. You will only start receiving the newsletter once you have clicked on this link. You can deactivate the newsletter at any time. To do so, please contact the operator or use the unsubscribe link provided in every newsletter. The lawfulness of data processing is governed by Article 6(1)(a) of the GDPR, according to which processing is lawful if the data subject has given consent to the processing of their personal data for one or more specific purposes. If you do not give your consent to the processing of your data, the operator will not be able to send you the newsletter. The personal data processed for the purpose of sending the newsletter will be deleted unless the controller has a legitimate interest in retaining it further. In any case, only those data that are absolutely necessary to achieve the relevant purpose will continue to be stored.

2.4. Online bookings, orders and the online shop
To process online bookings, booking enquiries, brochure orders and online shop orders, we process your personal data in order to provide you with the services you have booked, with the assistance of our service provider feratel Media Technologies AG (Maria-Theresien-Straße 8, A-6020 Innsbruck). We have entered into a corresponding agreement with feratel in accordance with Article 28 of the GDPR as a data processor, which ensures that your data is processed exclusively within the scope of our mandate. Further information on feratel’s data protection policy.

2.4.1 Online bookings
You can book various types of accommodation on the website. To do so, you must provide the following details:

• First name
• Surname
• Street, house number
• Postcode, town
• Telephone number
•  Email address

Your data will be used to process your booking and will be passed on to the accommodation provider accordingly. The lawfulness of this processing is based on Article 6(1)(b) of the GDPR, according to which processing is lawful if it is necessary for the performance of a contract to which the data subject is a party, or for the implementation of pre-contractual measures taken at the data subject’s request. The provision of your personal data is contractually required. Without this data, the operator cannot enter into a contract with you or process your booking. The personal data processed for the purpose of handling bookings and fulfilling contracts will be deleted once the statutory retention periods have expired, unless the controller has a legitimate interest in retaining it further. In any case, only those data that are absolutely essential for achieving the relevant purpose will continue to be stored.
As part of your booking, you have the option to review our company, your hosts and the trip. To this end, you will receive a one-off email from us a few days after booking, for which we will use the email address and name you have provided. By submitting a review of our company, you consent to us publishing your review on trustyou.com and on our websites. These reviews are provided on a voluntary basis. If you do decide to submit a review, we would like to thank you in advance; every piece of feedback helps us to further improve our service for you.

2.4.2 Non-binding booking enquiries
You can send a non-binding booking enquiry to the operator via a dedicated contact form. To do so, you must provide the following details:

• Number of guests
• Title
• First name
• Surname
• Street, house number
• Postcode, town
• Email address

Your data will be used to process your booking enquiry and to prepare a quote. The lawfulness of this processing is based on Article 6(1)(b) of the GDPR, according to which processing is lawful if it is necessary for the performance of a contract to which the data subject is a party, or for the implementation of pre-contractual measures taken at the data subject’s request. Without this data, the operator cannot respond to your enquiry or provide you with the requested information. The personal data processed for the purpose of handling a non-binding booking enquiry will be erased unless the controller has a legitimate interest in retaining it. In any case, only those data that are absolutely essential for achieving the relevant purpose will continue to be stored.

2.4.3 Ordering
brochures You have the option on the website to order various brochures. To do so, you must provide the following details:

• Title
• Middle name
• Surname
• Street, house number
• Postcode, town
• Country
•  Email address

Your data will be used to send you the brochure you have ordered. The lawfulness of this processing is based on Article 6(1)(b) of the GDPR, according to which processing is lawful if it is necessary for the performance of a contract to which the data subject is a party, or for the implementation of pre-contractual measures taken at the data subject’s request. The provision of your personal data is contractually required. Without this data, the operator cannot send you a brochure. The personal data processed for the purpose of sending the brochure will be erased unless the controller has a legitimate interest in retaining it further. In any case, only those data that are strictly necessary for achieving the relevant purpose will continue to be stored. 

2.4.4 Online shop orders
You can order books, cards, holiday vouchers and merchandise from our online shop. To do so, you must provide the following details:

• Title
• Middle name
• Surname
• Street, house number
• Postcode, town
• Country
• Email address

Your details will be used to process your booking. The data will be passed on to the service providers.

Credit card / Stripe
If
you choose a payment method offered via the payment service provider ‘Stripe’, payment processing will be carried out by Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland, to whom we will pass on the information you provide during the transaction (name, address, account number, sort code, credit card number if applicable, invoice amount, currency and transaction number) in accordance with Article 6(1)(b) of the GDPR. Your data is disclosed exclusively for the purpose of payment processing with Stripe Payments Europe Ltd. and only to the extent necessary for this purpose. Further information on Stripe’s data protection policy can be found at the following web address: https://stripe.com/de/privacy#translation.

The lawfulness of this processing is based on Article 6(1)(b) of the GDPR, according to which processing is lawful if it is necessary for the performance of a contract to which the data subject is a party, or for the implementation of pre-contractual measures taken at the data subject’s request.

The provision of your personal data is contractually required. Without this data, the operator cannot supply you with a product. The personal data processed for the purpose of product dispatch will be erased unless the controller has a legitimate interest in retaining it further. In any case, only those data that are absolutely necessary to achieve the relevant purpose will continue to be stored.

2.4.5 Electronic withdrawal function
If you use the electronic withdrawal function provided on our website, we process the personal data you enter in order to link your withdrawal to the relevant contract,
to process it and to confirm receipt of your withdrawal without delay. Depending on the design of the form, we process the following data in particular:

• First name
• Surname
• Email address
• Order number
• where applicable, any further details you voluntarily provide to us as part of your notice of withdrawal

Your personal data is processed to fulfil our legal obligations in connection with the provision of the electronic withdrawal function and the transmission of a confirmation of receipt in accordance with Section 356a of the German Civil Code (BGB), on the basis of Article 6(1)(c) of the GDPR. Insofar as the processing is necessary to handle your withdrawal and to rescind the contract, it is also carried out on the basis of Article 6(1)(b) of the GDPR.

Where individual fields in the withdrawal form are marked as mandatory, these are required so that we can assign your withdrawal to the relevant contract and process it.

The personal data processed in connection with your withdrawal will be stored for the duration of the statutory retention periods. Storage beyond this period will only take place insofar as this is necessary for the establishment, exercise or defence of legal claims. Once the relevant time limits have expired, the data will be deleted.

2.5 Use of cookies
The operator uses so-called cookies. These are small data packets, usually consisting of letters and numbers, which are stored on a browser when you visit certain web pages. Cookies enable the website to recognise your browser, track your movements as you navigate through different sections of the website, and identify you when you return to the website. Cookies do not contain any data that personally identifies you, but the information about you stored by the operator can be linked to the data obtained from the cookies and stored within them. Information that the operator obtains from you through the use of cookies may be used for the following purposes:

• Recognising the user’s computer when they visit the website
• Tracking the user’s browsing activity on the website
• To improve the user-friendliness of the website
• Analysing the use of the website
• Operating the website
• Prevention of fraud and improvement of the website’s security
• Tailoring the website to users’ needs

Cookies do not cause any damage to a browser. They do not contain viruses and do not allow the operator to spy on you. Two types of cookies are used:

• Temporary cookies are automatically deleted when you close your browser (session cookies).
• Permanent cookies, on the other hand, have a maximum lifespan of up to 20 days. This type of cookie enables the operator to recognise you when you return to the website after leaving it.

Cookies enable the operator to track your usage behaviour for the purposes mentioned above and to the extent necessary. They are also intended to optimise your browsing experience on the operator’s website. The operator collects this data solely in anonymised form.

The lawfulness of this processing is based on Article 6(1)(f) of the GDPR. The operator’s legitimate interest lies in the optimised presentation of its website. You can, of course, view the website without cookies. If you do not wish the operator to recognise your computer, you can prevent cookies from being stored on your hard drive by selecting ‘do not accept cookies’ in your browser settings. Please refer to your browser manufacturer’s instructions for details on how this works. To delete cookies already set by your browser, please also refer to your browser’s instructions. The provision of data is necessary to ensure that the operator’s website can be accessed without errors. If you do not accept cookies or delete cookies that have already been set, this may result in the website’s functionality being restricted. Temporary cookies are automatically deleted when you close your browser (session cookies). Persistent cookies, on the other hand, have a maximum lifespan of up to 20 days. This type of cookie enables you to be recognised when you revisit the website after leaving it.

2.4.5 Electronic withdrawal function
If you use the electronic withdrawal function provided on our website, we will process the personal data you enter in order to link your withdrawal to the relevant contract,
process it and confirm receipt of your withdrawal without delay. 

Depending on the design of the form, we process the following data in particular:

• First name
• Surname
• Email address
• Order number
• where applicable, any further details you voluntarily provide to us as part of your notice of withdrawal

Your personal data is processed to fulfil our legal obligations in connection with the provision of the electronic withdrawal function and the transmission of a confirmation of receipt in accordance with Section 356a of the German Civil Code (BGB), on the basis of Article 6(1)(c) of the General Data Protection Regulation (GDPR). Insofar as the processing is necessary to handle your withdrawal and to rescind the contract, it is also carried out on the basis of Article 6(1)(b) of the GDPR.

Where individual fields in the withdrawal form are marked as mandatory, these are required so that we can assign your withdrawal to the relevant contract and process it.

The personal data processed in connection with your withdrawal will be stored for the duration of the statutory retention periods. Data will only be retained beyond this period where
necessary to establish, exercise or defend legal claims. Once the relevant time limits have expired, the data will be deleted.

The operator of the Google Analytics component is Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.

The data controller uses the add-on “_gat._anonymizeIp” for web analytics via Google Analytics. This parameter causes Google to truncate and anonymise the IP address of the data subject’s internet connection when accessing our website from a Member State of the European Union or from another signatory state to the Agreement on the European Economic Area.

The anonymisation of your IP address is already set as the default in Google Analytics. The purpose of the Google Analytics component is to analyse visitor traffic on our website. Google uses the data and information collected, amongst other things, to evaluate the use of our website, to compile online reports for us showing activity on our website, and to provide other services related to the use of our website.

Google Analytics uses AI to predict the behaviour of individual visitor groups. Changing customer needs are tracked, enabling forecasts to be made regarding future usage patterns.

Google Analytics places a cookie on the data subject’s IT system. What cookies are has already been explained above. The placement of the cookie enables Google to analyse the use of our website. Each time a user accesses one of the individual pages of this website, which is operated by the data controller and on which a Google Analytics component has been integrated, the web browser on the data subject’s IT system is automatically prompted by the relevant Google Analytics component to to transmit data to Google for the purpose of online analysis. As part of this technical process, Google obtains personal data, such as the data subject’s IP address, which Google uses, amongst other things, to trace the origin of visitors and clicks and, consequently, to facilitate commission settlements.
Personal information, such as the time of access, the location from which access originated and the frequency of the data subject’s visits to our website, is stored by means of a cookie. Each time our website is visited, this personal data – including the IP address of the internet connection used by the data subject – is transmitted to Google in the United States of America. This personal data is stored by Google in the United States of America. Google may, under certain circumstances, pass on this personal data, collected via the technical process, to third parties.

The data subject may, as described above, prevent our website from setting cookies at any time by adjusting the settings of the web browser they are using, thereby permanently objecting to the setting of cookies. Adjusting the settings of the internet browser used in this way would also prevent Google from setting a cookie on the data subject’s IT system. Furthermore, a cookie already set by Google Analytics can be deleted at any time via the internet browser or other software programmes.  

Furthermore, the data subject has the option to object to the collection of data generated by Google Analytics relating to the use of this website, as well as to the processing of such data by Google, and to prevent such processing. To do this, the data subject must download and install a browser add-on from the link tools.google.com/dlpage/gaoptout. This browser add-on uses JavaScript to inform Google Analytics that no data or information regarding visits to websites may be transmitted to Google Analytics. Google regards the installation of the browser add-on as an objection. If the data subject’s IT system is subsequently deleted, formatted or reinstalled, the data subject must reinstall the browser add-on in order to deactivate Google Analytics. If the browser add-on is uninstalled or deactivated by the data subject or by another person within their control, it is possible to reinstall or reactivate the browser add-on.

Further information and Google’s applicable data protection policies can be found at https://www.google.de/intl/de/policies/privacy/ and at http://www.google.com/analytics/terms/de.html. Google Analytics is explained in more detail at this link: https://www.google.com/intl/de_de/analytics/.

The data controller has integrated components of the Instagram service into this website. Instagram is a service that qualifies as an audiovisual platform and enables users to share photos and videos, as well as to redistribute such data on other social networks.
The operator of the Instagram services is Instagram LLC, 1 Hacker Way, Building 14 First Floor, Menlo Park, CA, USA.
Each time a user accesses one of the individual pages of this website, which is operated by the data controller and on which an Instagram component (Insta button) has been integrated, the web browser on the data subject’s IT system is automatically prompted by the respective Instagram component to download a representation of the relevant Instagram component. As part of this technical process, Instagram becomes aware of which specific subpage of our website is being visited by the data subject.
If the data subject is logged into Instagram at the same time, Instagram recognises, each time the data subject accesses our website and throughout the entire duration of their visit to our website, which specific subpage the data subject is visiting. This information is collected by the Instagram component and linked by Instagram to the data subject’s respective Instagram account. If the data subject clicks on one of the Instagram buttons integrated into our website, the data and information transmitted in this way are associated with the data subject’s personal Instagram user account and are stored and processed by Instagram.
Instagram always receives information via the Instagram component that the data subject has visited our website if the data subject is logged into Instagram at the same time as accessing our website; this occurs regardless of whether the data subject clicks on the Instagram component or not. If the data subject does not wish for this information to be transmitted to Instagram, they can prevent such transmission by logging out of their Instagram account before visiting our website.
Further information and Instagram’s applicable privacy policy can be found at https://help.instagram.com/ and https://www.instagram.com/about/legal/privacy/.

2.7.2 Data protection provisions regarding the use of YouTube
The data controller has integrated YouTube components into this website. YouTube is an online video portal that enables video publishers to upload video clips free of charge and allows other users to view, rate and comment on them, also free of charge. YouTube permits the publication of all types of videos, which is why complete films and television programmes, as well as music videos, trailers and user-generated videos, are available via the internet portal.
The service at de.youtube.com is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Whenever a user accesses one of the individual pages of this website, which is operated by the data controller and on which a YouTube component (YouTube video) has been integrated, the web browser on the data subject’s IT system is automatically prompted by the respective YouTube component to download a display of the corresponding YouTube component from YouTube. Further information on YouTube can be found at https://www.youtube.com/yt/about/de/. As part of this technical process, YouTube and Google become aware of which specific subpage of our website is being visited by the data subject.
If the data subject is logged into YouTube at the same time, YouTube recognises which specific subpage of our website the data subject is visiting when a subpage containing a YouTube video is accessed. This information is collected by YouTube and Google and linked to the data subject’s respective YouTube account.
YouTube and Google always receive information via the YouTube component to the effect that the data subject has visited our website if the data subject is logged into YouTube at the same time as accessing our website; this occurs regardless of whether the data subject clicks on a YouTube video or not. If the data subject does not wish for this information to be transmitted to YouTube and Google, they can prevent such transmission by logging out of their YouTube account before accessing our website.
The privacy policy published by YouTube, which is available at https://www.google.de/intl/de/policies/privacy/, provides information on the collection, processing and use of personal data by YouTube and Google.

2.7.3 Privacy Policy on the Use of Facebook
The data controller has integrated components from Facebook into this website. Facebook is a social network.
A social network is an online social hub, an online community that generally enables users to communicate with one another and interact in a virtual space. A social network can serve as a platform for exchanging opinions and experiences, or enable the online community to share personal or business-related information. Among other things, Facebook enables users of the social network to create private profiles, upload photos and connect with others via friend requests.
The operator of Facebook is Facebook, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA. Where a data subject resides outside the USA or Canada, the data controller for the processing of personal data is Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
Each time a user accesses one of the individual pages of this website, which is operated by the data controller and on which a Facebook component (Facebook plug-in) has been integrated, the web browser on the data subject’s IT system is automatically prompted by the respective Facebook component to download a representation of the corresponding Facebook component from Facebook. A complete overview of all Facebook plug-ins can be found at https://developers.facebook.com/docs/plugins/?locale=de_DE. As part of this technical process, Facebook becomes aware of which specific subpage of our website is being visited by the data subject.
Provided the data subject is logged into Facebook at the same time, Facebook recognises, each time the data subject accesses our website and throughout the duration of their visit to our website, which specific subpage of our website the data subject is visiting. This information is collected by the Facebook component and linked by Facebook to the data subject’s respective Facebook account. If the data subject clicks on one of the Facebook buttons integrated into our website – for example, the ‘Like’ button – or if the data subject posts a comment, Facebook associates this information with the data subject’s personal Facebook user account and stores this personal data.
Facebook always receives information via the Facebook component that the data subject has visited our website if the data subject is logged into Facebook at the same time as accessing our website; this occurs regardless of whether the data subject clicks on the Facebook component or not. If the data subject does not wish such information to be transmitted to Facebook, they can prevent this by logging out of their Facebook account before visiting our website.
Facebook’s privacy policy, which is available at https://de-de.facebook.com/about/privacy/, provides information on the collection, processing and use of personal data by Facebook. It also explains the settings options Facebook offers to protect the data subject’s privacy. In addition, various applications are available that enable data transmission to Facebook to be prevented. The data subject may use such applications to prevent data transmission to Facebook.
Where a competition is running on the ‘Mosel’ Facebook page, separate terms and conditions of participation apply for the duration of the competition.

2.8 Use of Google Web Fonts
This site uses so-called web fonts, provided by Google, to ensure a consistent display of typefaces. The Google Fonts are installed locally. No connection is made to Google’s servers in the process. Further information on Google Web Fonts can be found at https://developers.google.com/fonts/faq and in Google’s privacy policy: https://policies.google.com/privacy?hl=de.

2.9 Use of widgets from the DataHub Rhineland-Palatinate
To display map information, events, images and other tourist information, we sometimes use the DataHub Rhineland-Palatinate, a service provided by Rheinland-Pfalz Tourismus GmbH, Löhrstraße 103–105, 56068 Koblenz. When you visit this website, your IP address, device and browser identifiers, as well as any information regarding your use of this website, are transmitted to the Rhineland-Palatinate DataHub and all service providers involved in the operation of the service.

The lawfulness of this processing is based on Article 6(1)(b) of the GDPR (contractual relationship). The data processing is necessary in order to provide and display the above-mentioned information to you in a clear and organised manner. A static integration would not be suitable for providing the existing functions.

Further information on the collection and processing of your data by DataHub Rhineland-Palatinate can be found in the privacy policy of Rheinland-Pfalz Tourismus GmbH at https://rlp.tourismusnetzwerk.info/datenschutzerklaerung/.

3.1 Right of access
Upon request, the controller will inform you whether it is processing data relating to you. The controller endeavours to process requests for access promptly.

3.2 Right to rectification
You have the right to request that the controller rectify any inaccurate personal data relating to you without delay. 

3.3 Right to erasure
You have the right to request that the controller erase personal data relating to you without undue delay, and the operator is obliged to erase personal data without undue delay if any of the grounds set out in Article 17(1)(a)–(f) of the GDPR apply.

3.4 Right to restriction
of processing You have the right to request that the controller restrict the processing of your personal data where one of the conditions set out in Article 18(1)(a)–(d) of the GDPR is met.

3.5 Right to object
You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you carried out on the basis of Article 6(1)(e) or (f) of the GDPR; this also applies to profiling based on these provisions. The controller shall no longer process your personal data unless it can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims. If your personal data is processed for the purposes of direct marketing, you have the right to object at any time to the processing of your personal data for the purposes of such marketing; this also applies to profiling insofar as it is related to such direct marketing. You have the right to object, on grounds relating to your particular situation, to the processing of your personal data carried out for scientific or historical research purposes or for statistical purposes in accordance with Article 89(1) of the GDPR, unless the processing is necessary for the performance of a task carried out in the public interest. Please use the contact address provided in the legal notice to send your notification. 

3.6 Right to data portability
You have the right to receive the personal data concerning you, which you have provided to the operator, in a structured, commonly used and machine-readable format, and you have the right to transmit this data to another controller without hindrance from the controller to whom the personal data was provided, provided that the processing is based on consent pursuant to Article 6(1)(a) of the GDPR, Article 9(2)(a) of the GDPR or on a contract pursuant to Article 6(1)(b) of the GDPR, and the processing is carried out by automated means.