1. Name and address of the responsible person

The responsible person within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws of the member states as well as other data protection regulations is:

Hessische Heimvolkshochschule BURG FÜRSTENECK e.V.
Am Schlossgarten 3
36132 Eiterfeld-Fürsteneck
Germany
Phone Number: (06672) 92020
E-mail Address: bildung(at)burg-fuersteneck.de
Website: www.burg-fuersteneck.de

In the following we would like to inform you about the processing of your personal data when you use our website.

If you have any questions about data protection in connection with our website or with the services offered by us, please get in touch with our data protection officer.

The data protection officer of the responsible person is:

Rudolf Fiedler
DPP Data Protection GmbH
E-Mail Address: info(at)dataprotectionpartner.de

2. Scope, purpose and legal basis for the personal data processing

We generally only collect and use the personal data of our users if this is required for the provision of a functional website as well as of our content and services. The personal data of our users are collected and used regularly only if the user agrees. An exception applies in cases in which a prior consent cannot be obtained for factual reasons and if the processing of the data is permitted according to the legal

2.1       Use of cookies

Our website uses cookies. Cookies are text files stored in the internet browser or by the internet browser on the computer system of the user. If a user calls up a website, a cookie may be stored on the user's operating system. This cookie contains a characteristic string enabling the browser to be clearly identified as soon as the website is called up again.

We use cookies to make our website more user-friendly. Some elements of our website require that the calling browser can also be identified after a page change.

The user data collected this way are pseudonymised by using technical precautions. This is the reason why it is no longer possible to assign the data to the accessing user. The data are not stored together with the other personal data of the users.

During the calling-up of our website an information banner informs the users about the use of cookies for analysis purposes and refers them to the present data protection declaration. In this context, there is also a note on how to prevent the storage of cookies in the browser settings.

The legal basis for the processing of personal data using technically required cookies is art. 6, para. 1, lit. f) of the GDPR.

The legal basis for the data processing by using cookies for analysis purposes is art. 6, para. 1, lit. a of the GDPR, if there is the respective agreement by the user.

The cookies are stored on the user's computer and transmitted from there to our website. For this reason, as a user you have the full control over the use of cookies. By a modification of the settings in your Internet browser, you can deactivate or restrict the transmission of cookies. Cookies which have already been saved can be deleted at any time. This can also be carried out automatically. If the cookies are deactivated for our website, it could not be possible to make use of all functions of the website to their full extent.

2.2. Newsletter

On our website, you can subscribe to a free newsletter. In this context, during the newsletter subscription, the data from the input mask will be transmitted to us.

In addition, the following data is collected upon registration:

1. IP address of the calling computer
2. Registration date and time

We use your data in connection with the newsletter in order to send you information related to our range of products and services. We also use the email address entered to send you personalised offers.

The collection of the user's email address serves to the newsletter submission.

The legal basis for the data processing after the registration of the newsletter by the user is art. 6, para. 1, lit. a of the GDPR, if there is the agreement by the user.

The data will be deleted as soon as it is no longer required to achieve the purpose for which they were collected. As a consequence, the e-mail address of the user will only be stored as long as the subscription to the newsletter is active.

Subscription to the newsletter may be terminated at any time by the affected user. For this purpose, there is a corresponding link in each newsletter.

2.3. Registration

On our website we offer users the opportunity to register by providing their personal data. The data is entered in an input mask and then transmitted to us and saved. A transmission of the data to third parties does not take place. The following data will be collected as part of the registration process:

1. The IP address of the user
2. Registration date and time

The legal basis for the data processing is art. 6, para. 1, lit. a of the GDPR, if there is the agreement by the user.

If the registration serves to the fulfilment of a contract to which the user is a party or to carry out any pre-contractual measures, then the additional legal basis for the processing of the data will b art. 6 para. 1 lit. b GDPR.

As a user, you have the option of cancelling the registration at any time. You can change the data stored about you at any time.

If the data is necessary for the fulfilment of a contract or to carry out any pre-contractual measures, then the data can only be deleted prematurely unless there are contractual or legal obligations preventing this deletion.

2.4. Tracking tools

On our website, we use the following tracking and website analysis tools:

• Google Analytics.

The purpose is to increase the efficiency of our website and of the direct marketing. These tools are operated by third parties and require the disclosure of data relate to the website visitors.

The legal basis for the use of the website analysis is art. 6 para. 1 sentence 1 lit. f) GDPR.

2.5. Social media plugins

On our website, we use the following social media plugins:

• Facebook
• Twitter
• Instagram
• You Tube

The basic provision of the plugins on our website results from our legitimate interest for marketing purposes according to art. 6 para. 1 lit. f GDPR.

2.6. Marketing services

On our website, we use the following marketing services:

• Google Adwords.

The basic provision of the marketing services on our website results from our legitimate interest for marketing purposes according to art. 6 para. 1 lit. f GDPR.

3. Legal basis for the processing of personal data

Insofar as we obtain the data subject's consent for the processing of personal data, the art. 6, para. 1, lit. of the EU General Data Protection Regulation (GDPR) serves as the legal basis for the personal data processing.

During the personal data processing required for the performance of a contract to which the data subject is a party, the art. 6, para. 1, lit. b of the GDPR serves as the legal basis. This principle also applies to processing operations required to carry out pre-contractual measures.

Insofar as the processing of personal data is required for the fulfilment of a legal duty to which our company is subject, the art. 6, para. 1, lit. c of the GDPR serves as the legal basis.

If vital interests of the data subject or another natural person require the processing of personal data, the art. 6, para. 1, lit. d of the GDPR serves as the legal basis.

If the processing is required to safeguard the legitimate interests of our company or of a third party and the interests, fundamental rights and freedoms of the data subject do not outweigh the former interest, the art. 6, para. 1, lit. f of the GDPR serves as the legal basis for processing. In this case, our legitimate interests in addition to the purposes listed above will be the following:

• The protection of the company against material or immaterial damage
• The professionalization of our products and services
• Cost optimization.

We process personal data in order to comply with commercial or tax retention requirements as well.

For statutory or contractual requirements, we have marked the respective input fields in the input masks on our website. You have to fill them out so that we can provide the service required by you.

4. Deletion of data and storage duration

The personal data of the involved person will be deleted or blocked as soon as the purpose of the storage is omitted or is not required any more. In this context, it may happen that personal data is kept for the time in which claims can be made against our company (the respective statutory limitation periods may be from three to thirty years).

In addition, a storage can take place if this has been provided for by the European or national legislator in EU regulations, laws or other regulations the responsible person is subject to.

The respective proof and retention obligations result from the German Commercial Code, the German Tax Code and the German Money Laundering Act. According to them, the storage periods are up to ten years.

The data will also be blocked or deleted if a storage period prescribed by the standards mentioned expires, unless there is a need for further data storage to conclude or perform a contract.

5. Disclosure of personal data to third parties

In order to be able to offer you our products and services according to our contractual obligations or our legitimate interests, there is the possibility that we will transmit your personal data to the lecturers of the courses specified by us. In this context, only the information listed in the following will be transmitted:

• E-mail address
• Phone number
• Age group
• Educational background.

We have informed all lecturers about the confidentiality of your personal data. In addition, your data may only be used for the purpose of the preparation for the event booked by you.

If you do not agree to the disclosure to the lecturers, please inform us.

In addition, we may be legally obliged to provide personal data to the German and international authorities. The legal basis for this is art. 6 para. 1 lit. c GDPR in connection with the local and international regulations and agreements.

6. Right to object in accordance with Art. 21 GDPR

For reasons arising from your particular situation, you have the right, at any time, to object against the Processing of personal data related to you, which was carried out pursuant to art. 6 para. 1 lit. e or f GDPR. This also applies to profiling based on these provisions.

The responsible person does not process your personal data any more, unless the person can demonstrate compelling legitimate grounds for processing that outweigh your interests, rights and freedoms, or the processing is carried out for the purposes of asserting, exercising or defending legal claims.

If personal data is processed in order to operate Direct mail activities, you have the right to object at any time against the processing of your personal data for the purpose of such advertising; this also applies to profiling, insofar as it is associated with such direct mail activities.

If you oppose to the processing for direct marketing purposes, your personal data will no longer be processed for these purposes.

Regardless of the Directive 2002/58/EC, you have the opportunity of exercising your opposition right in connection with the use of services of the information society by using automated procedures that use technical specifications.

7. Rights of the involved person

It is very important to our company to make our processes concerning the processing of personal data transparent. This is why we would like to point out that in addition to the right to object, if the relevant legal requirements are met, you can exercise other rights:

• Right to Information in accordance with art. 15 GDPR
• Right to Correction in accordance with art. 16 GDPR
• Right to Deletion (“Right to be forgotten”) in accordance with art. 17 GDPR
• Right to Restriction of processing in accordance with art. 18 GDPR
• Right to Indication in accordance with art. 19 GDPR
• Right to Data Portability in accordance with art. 20 GDPR
• (No) automated decision in individual cases including the profiling in accordance with art. 21 GDPR

In order to exercise your rights, you can send an email to datenschutz(at)burg-fuersteneck.de.

For the processing of your application and for identification purposes, we would like to point out that we are entitled to process your personal data in accordance with art. 6 para. 1 lit. c Process GDPR.

8. Declaration of consent

You have the right to revoke your declaration of consent under the data protection law at any time with effect for the future. The revocation of the consent does not affect the legality of the processing carried out on the basis of the consent given, until the revocation. In some cases, despite the revocation, we are entitled to the further processing of your personal data on different legal basis (to fulfil a contract).

9. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you are entitled to complain to a supervisory authority, in particular to that in the Member State of your residence, place of work or place of alleged infringement, if you think that the processing of personal data related to you violates the GDPR.

The competent supervisory authority is the following:
Der Hessische Datenschutzbeauftragte
Gustav-Stresemann-Ring 1
65189 Wiesbaden
poststelle(at)datenschutz.hessen.de

The supervisory authority the complaint was lodged to has to inform the complainant of the status and results of the complaint, including the option of a judicial remedy according to art. 78 of the GDPR.