Privacy Policy

Bad Nauheim, a Kneipp spa town in Hesse, Germany

Privacy Policy

bad-nauheim.de

The city of Bad Nauheim operates the official city portal under the domain bad-nauheim.de. The city of Bad Nauheim places great importance on protecting your privacy and complies with all applicable data protection regulations. We take all necessary measures to protect the personal data you provide and to ensure compliance with applicable national and European data protection laws. Below, we inform you about the purpose and legal basis for processing this data, to whom the data is disclosed, how long it is stored, and what rights you have.

A. General

I. Scope
This privacy policy applies from May 25, 2018 to the website www.bad-nauheim.de operated by the city of Bad Nauheim, including any subpages.

II. Controller and Data Protection Officer
The City of Bad Nauheim, located at the Town Hall, Parkstraße 36-38, 61231 Bad Nauheim, is responsible for your personal data. You can reach the City of Bad Nauheim's Data Protection Officer, Attorney Konrad Dörner, at [contact information missing in original text]. datenschutz@bad-nauheim.de, telephone 06032-9290835 or Data Protection Officer c/o Magistrat der Stadt Bad Nauheim, Parkstraße 36-38, 61231 Bad Nauheim.

Bad Nauheim Stadtmarketing und Tourismus GmbH (BNST), In den Kolonnaden 1, 61231 Bad Nauheim, is responsible for the personal data collected in connection with our tourist offers and programs. You can reach the BNST data protection officer at [contact information missing in original text]. anfrage@konrad-doerner.de  or lawyer Konrad Dörner, Dunkerstraße 4, 61231 Bad Nauheim.

B. Processing of your data

I. Website

1. Provision of the website

a. Description of data processing
Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing device. The following data is collected:

  • Information about the browser type and version used
  • The user's operating system
  • The user's internet service provider
  • Access status (http status)
  • The user's IP address
  • Date and time of access
  • Websites from which the user's system accessed our website
  • Websites accessed by the user's system via our website

The data is also stored in our system's log files. This data is not stored together with other personal data of the user.

b. Purpose of processing and legal basis
The temporary storage of the IP address by the system is necessary to enable the delivery of the website to the user's computer. For this purpose, the user's IP address must be stored for a period of seven days. Storage in log files is carried out to ensure the functionality of the website. In addition, the data helps us to optimize the website and to ensure the security of our IT systems. The data is not used for marketing purposes in this context.

The legal basis for the temporary storage of the data is Article 6(1)(f) GDPR. The legitimate interest in data processing pursuant to Article 6(1)(f) GDPR arises from maintaining the functionality of the website.

c. Recipients of the data and storage period
The data is stored for hosting purposes at rackSPEED GmbH, Reisholzer Werftstraße 31b / Entrance 35, 40589 Düsseldorf and deleted after 7 days at the latest.

d. Right to object and have the matter rectified
The collection of data for the provision of the website and the storage of data in log files is essential for the operation of the website. Therefore, there is no possibility for the user to object.

2. Use of cookies

a. Description of data processing
Our website uses cookies. Cookies are text files that are stored in or by the internet browser on the user's computer system. When a user visits a website, a cookie can be stored on the user's operating system. This cookie contains a characteristic string that enables the browser to be uniquely identified when the website is visited again.

(1) Technically necessary cookies
We use cookies to make our website more user-friendly. Some elements of our website require that the requesting browser can be identified even after a page change.

The following cookies are used:

  • Cookie Notice
  • User login

When you visit our website, a banner informs you about the use of cookies for analytical purposes and refers you to this privacy policy. The banner also explains how you can prevent cookies from being stored in your browser settings.

(2) Google Analytics
We use Google Analytics, a web analytics service provided by Google Inc. ("Google"), for our websites. Google uses cookies, which are stored on your computer.

b. Purpose of processing and legal basis

(1) Technically necessary cookies

The purpose of using technically necessary cookies is to simplify website use for users. Some functions of our website cannot be offered without the use of cookies. For these functions, it is necessary that the browser is recognized even after a page change. We require cookies for the following applications:

  • When the user has confirmed the cookie notice.
  • When registering to create an event.

The user data collected through technically necessary cookies is not used to create user profiles. The legal basis for processing personal data using cookies is Article 6(1)(f) GDPR. Our legitimate interest in processing personal data pursuant to Article 6(1)(f) GDPR also lies in the aforementioned purpose.

(2) Google Analytics
The purpose of the cookies used by Google Analytics is to analyze your use of the website. Google will use this information on our behalf to evaluate the use of our online services by users, to compile reports on activity within these online services, and to provide us with other services relating to the use of these online services and internet usage. Pseudonymous user profiles may be created from the processed data. We only use Google Analytics with activated IP anonymization. This means that Google will shorten the IP address of users within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. The IP address transmitted by the user's browser will not be merged with other Google data. The legal basis for this processing is Article 6(1)(f) GDPR. The legitimate interest in processing personal data pursuant to Art. 6 para. 1 lit. f GDPR lies in the needs-based design of our website.

Disable Google Analytics

c. Recipients of the data and storage period
The information obtained through Google Analytics cookies regarding the use of this website is generally transmitted to and stored by Google on a server in the USA. All other information collected through technically necessary or performance cookies is not shared with third parties and is deleted as soon as it is no longer required for the purpose for which it was collected (cookie notice: 1 month/login: closing the browser).

d. Right to object and have the matter rectified

(1) Cookies
As a user, you have control over the use of cookies on your computer. By changing the settings in your internet browser, you can deactivate or restrict the transmission of cookies. Cookies that have already been saved can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, some of its functions may no longer be fully available. It is possible to block many online advertising cookies from companies via the US website. http://www.aboutads.info/choices or the European website http://www.youronlinechoices.com/uk/your-ad-choices/ to manage. The transmission of Flash cookies cannot be prevented via the browser settings, but can be prevented by changing the settings of the Flash Player.

(2) Google Analytics
You can prevent Google Analytics from storing cookies by adjusting your browser settings accordingly; users can also prevent Google from collecting and processing data generated by the cookie and related to their use of the online service. You can object to the creation of pseudonymous user profiles at any time. There are several ways to do this:

You can object to web analytics by Google Analytics by setting an opt-out cookie, which instructs Google not to store or use your data for web analytics purposes. Please note that with this solution, web analytics will only be disabled as long as the opt-out cookie is stored by your browser. If you would like to set the opt-out cookie now, please click here. here.

You can also prevent the storage of cookies used for profiling by adjusting your browser software settings accordingly.

Depending on the browser you are using, you may be able to install a browser plugin that prevents tracking. To do this, please click here. here and install the browser plugin available there. Alternatively, you can disable tracking here:

Disable Google Analytics

3. Social Plugins

a. Description of data processing
Our website also contains buttons that allow you to interact with various social media networks. You can activate these social plugins ("plugins"), which will result in the transmission of data to the respective social media provider, including the address of the website where the plugin is located, the date and time of your visit, information about your browser and operating system, and your current IP address. If you are already logged into the relevant network when you activate the plugin, the plugin can also determine your username and, if applicable, your real name from the aforementioned data. Our website uses plugins from the social networks facebook.com, instagram.com, and vimeo.com. The plugins can be identified by one of the Facebook logos (a white "f" on a blue tile, the terms "Like", "Gefällt mir" or a "thumbs up" symbol) or are marked with the addition "Facebook Social Plugin", the Instagram and Vimeo plugins can be identified by their respective logos.

b. Purpose of processing and legal basis
The purpose and scope of data collection and the further processing and use of the data can be found in Facebook's privacy policy. https://www.facebook.com/about/privacy/, on Instagram under https://help.instagram.com, on Vimeo under https://vimeo.com/privacy and on YouTube under  https://policies.google.com/privacy. When a user accesses a feature of these online services that contains such a plugin, their device establishes a direct connection to the servers of Facebook, Instagram, or Vimeo. The plugin's content is transmitted directly from Facebook, Instagram, Vimeo, or YouTube to the user's device and integrated into the online service. Usage profiles of users can be created from the processed data. We therefore have no influence on the scope of data that Facebook, Instagram, Vimeo, or YouTube collect using this plugin and are informing users accordingly, based on our current knowledge. By integrating the plugins, the companies receive information that a user has accessed the corresponding page of the online service. If the user is logged into Facebook, Instagram, Vimeo, or YouTube, the respective company can associate the visit with their account. When users interact with the plugins, for example, by clicking the "Like" button or leaving a comment, the corresponding information is transmitted directly from their device to Facebook, Instagram, Vimeo, or YouTube and stored there. Even if a user is not a member of Facebook, it is still possible that Facebook will learn and store their IP address. According to Facebook, only an anonymized IP address is stored in Germany. The legal basis for the use of the Facebook plugin is the legitimate interest in data processing pursuant to Art. 6 para. 1 lit. f GDPR. This legitimate interest arises from providing a comprehensive range of services on our website.

c. Recipients of the data and storage period
According to Facebook's privacy policy (Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland), information is shared internally within the company group or with third parties. Instagram was acquired by Facebook in 2012, and the company states in its privacy policy that information is shared between the companies. Information collected within the European Economic Area („EEA“) may be transferred to countries outside the EEA for the purposes described in the policy. Facebook states that it uses standard contractual clauses approved by the European Commission, takes other measures in accordance with EU law, and obtains your consent to legitimize data transfers from the EEA to the USA and other countries. Facebook states that it stores data for as long as necessary to provide products and services to users and others. Information associated with a user account remains with Facebook or Instagram until the account is deleted, unless the companies no longer need the data to provide products and services. When using the Vimeo plugin, your data will be processed by Vimeo Inc., 555 West 18th Street, New York, New York 10011. Further information on their privacy policy can be found at [link to privacy policy]. https://vimeo.com/privacy.

d. Right to object and have the matter rectified
For information on how to manage your content and information on Facebook, see: https://www.facebook.com/about/privacy, on Instagram under https://help.instagram.com/369001149843369?helpref=page_content and on Vimeo under https://vimeo.com/privacy. Further settings and options to object to the use of data for advertising purposes are available within your Facebook profile settings:https://www.facebook.com/settings?tab=ads.

4. WhatsApp

a. Description of data processing
You can contact the Bad Nauheim Tourist Information (BNST) via WhatsApp. To do this, you need to save the phone number +49 (0)15146173915 as a contact on your smartphone. Then, when you open the WhatsApp app and send a message, the BNST will promptly answer any questions you may have about the city's program offerings Monday to Friday between 10:00 a.m. and 6:00 p.m., and on Sundays and public holidays between 11:00 a.m. and 4:00 p.m.

b. Processing method and legal basis
We will only use your phone number to answer your direct inquiry. We will not contact you by phone or WhatsApp for any other purpose. The legal basis for this is your implied consent pursuant to Art. 6 lit. a GDPR, given by sending us a message.

c. Recipients of the data storage period
Your data is processed by WhatsApp Inc., 1601 Wilow Road, Menlo Park, California 94025, USA. WhatsApp uses end-to-end encryption. Further details regarding data retention can be found at [link to privacy policy]. https://www.whatsapp.com/legal/.

d. Possibility of objection - removal
We will delete the phone number once the conversation with the user has ended. A conversation is considered ended when it is clear from the circumstances that the matter in question has been resolved. Additionally, you can contact us at any time via WhatsApp or at [phone number/email address]. info@bad-nauheim.de Please inform us that you do not wish to receive any further messages. We will then delete the chat immediately.
 

II. Newsletter
A) Newsletter: Bad Nauheim General, NewKult, Sustainability & Climate and Children's & Youth Office

1. Description of data processing
On our website, you have the option to subscribe to several free newsletters. We use the newsletter service provided by Sendinblue GmbH, Köpenicker Str. 126, 10179 Berlin. When you subscribe to the newsletter, the data from the input form is transmitted to Sendinblue GmbH. Your email address is required, and your first and last name are optional. Your consent for data processing is obtained via double opt-in during the registration process, and you are referred to the privacy policy of Sendinblue GmbH (product: newsletter2go)., https://www.newsletter2go.de/datenschutz/) refer.

2. Purpose of processing and legal basis
The collection of other personal data during the registration process serves to prevent misuse of the services or the email address used. The legal basis for processing the data after the user registers for the newsletter is consent pursuant to Art. 6 para. 1 lit. a GDPR.

3. Recipients of the data and storage period
The data is stored by the email service provider for the purpose of sending the newsletter. Further details regarding the storage period can be found here. https://www.newsletter2go.de/datenschutz.

4. Right to object and have the matter rectified
The newsletter subscription can be cancelled by the user at any time. A corresponding link is included in every newsletter for this purpose. This also allows the user to revoke their consent to the storage of the personal data collected during the registration process.

B) Newsletter: Official announcement

1. Description and scope of data processing
On our website, you have the option to subscribe to a free newsletter, "Official Announcements." If a user chooses to subscribe, the email address entered in the input form will be transmitted to us and stored. At the time the message is sent, the following data is also stored: the user's IP address and the date and time of registration. Your consent for the processing of this data will be obtained during the submission process, and you will be referred to this privacy policy.

2. Purpose of processing and legal basis
The personal data you enter in the registration form is used solely for sending you the newsletter. Other personal data processed during the registration process serves to prevent misuse of the registration form and to ensure the security of our IT systems. The legal basis for processing this data, if the user has given their consent, is Article 6(1)(a) GDPR.

3. Recipients and duration of storage
The data will not be shared with third parties. The data will be deleted when the user unsubscribes from the newsletter.

4. Right to object and have the matter rectified
The newsletter subscription can be cancelled by the user at any time. A corresponding link is included in every newsletter for this purpose. This also allows the user to revoke their consent to the storage of the personal data collected during the registration process. Furthermore, the user can object to the processing of their personal data. online-redaktion@bad-nauheim.de All personal data stored during newsletter registration will be deleted in this case.

III. Contact form and email contact

1. Description and scope of data processing
Our website includes contact forms that can be used to contact us electronically. If a user chooses to use this option, the data entered in the input fields will be transmitted to us and stored. This data includes: first name, last name, email address, and the message. You can also optionally provide your title, street address and house number, and telephone number. At the time the message is sent, the following data is also stored: the user's IP address and the date and time of registration. Your consent for the processing of this data will be obtained during the submission process, and you will be referred to this privacy policy.

Alternatively, you can contact us via the provided email address. In this case, the personal data you transmit with your email will be stored.
In this context, no data will be shared with third parties. The data will be used exclusively for processing the conversation.

2. Purpose of processing and legal basis
The processing of personal data from the input form serves solely to process your contact request. In the case of contact via email, this also constitutes the necessary legitimate interest in processing the data. The other personal data processed during the submission process serves to prevent misuse of the contact form and to ensure the security of our IT systems. The legal basis for processing the data, if the user has given consent, is Article 6(1)(a) GDPR. The legal basis for processing data transmitted in the course of sending an email is Article 6(1)(f) GDPR. If the email contact aims at concluding a contract, the additional legal basis for processing is Article 6(1)(b) GDPR.

3. Recipients and duration of storage
The data will not be shared with third parties and will be deleted every six months. For personal data from the contact form and data transmitted via email, this applies when the respective conversation with the user has ended. A conversation is considered ended when it is clear from the circumstances that the matter in question has been resolved. Personal data collected during the submission process will be deleted every six months, unless longer retention is required for reasons of documentation or legal obligations.

4. Right to object and have the matter rectified
The user has the right to withdraw their consent to the processing of their personal data at any time. If the user contacts us by email, they can object to the storage of their personal data at any time. In such a case, the conversation cannot be continued. The objection should be sent to online-redaktion@bad-nauheim.de to address. All personal data stored during the contact process will be deleted in this case.

IV. Create a user account

1. Description and scope of data processing
Our website includes a form that allows you to register as a user and add events to the event calendar on www.bad-nauheim.de. To register, you must provide the following information: last name, first name, email address, phone number, and password (mandatory fields). Optional information includes company/organization, job title, website, street address, house number, postal code, and city. When you submit the form, the following data will also be stored: your IP address and the date and time of registration. Your consent for data processing will be obtained during the submission process, and you will be referred to this privacy policy.

2. Purpose of processing and legal basis
The processing of personal data from the input form serves to verify who is adding events to our event calendar. The personal data processed during the submission process serves to prevent misuse of the event posting function and to ensure the security of our IT systems. The legal basis for processing the data, if the user has given consent, is Article 6(1)(a) GDPR.

3. Recipients and duration of storage
The data will not be shared with third parties and will be deleted as soon as it is no longer needed for the purpose for which it was collected. For personal data, this is the case if you do not use your account for more than 3 years, unless longer retention is required for reasons of documentation or legal obligations.

4. Right to object and have the matter rectified
The user has the right to withdraw their consent to the processing of their personal data at any time. If the user contacts us by email, they can object to the storage of their personal data at any time. In such a case, the conversation cannot be continued. The objection should be sent to online-redaktion@bad-nauheim.de to address. All personal data stored during the contact process will be deleted in this case.

V. Online Ticket Portal

1. Description and scope of data processing
On our website, you have the option to purchase tickets online for events in the city of Bad Nauheim. After selecting the event and the number of tickets, you will be redirected to our service provider Reservix's portal. There, you can choose to order tickets either using your Reservix login, as a new customer, or as a guest.

2. Purpose of processing and legal basis
Data processing is carried out by Reservix GmbH, Kaiserstraße 69, 60329 Frankfurt am Main, for the purpose of processing ticket orders. The legal basis for this processing is Art. 6 para. 1 letter b) GDPR (purchase contract).

3. Recipients and duration of storage
The data is stored by Reservix GmbH. Ticket purchase data must be retained for 10 years.

4. Right to object and have the matter rectified
Information on the processing of your personal data by Reservix GmbH can be found at https://www.adticket.de/datenschutz.html.

VI. Subscription order for event series

1. Description and scope of data processing
On our website, you have the option to purchase online subscriptions for the city's event series. If a user takes advantage of this option, the data entered in the input form will be transmitted to us and stored. This data includes: title, first name, last name, street, house number, postal code, city, email address, customer status, and number of subscriptions. You can also voluntarily provide your telephone number and fax number. At the time the message is sent, the following data is also stored: the user's IP address and the date and time of registration. Your consent for the processing of this data will be obtained during the submission process, and you will be referred to this privacy policy.

2. Purpose of processing and legal basis
We process the personal data from the input form to process your order. The legal basis for processing this data, if the user has given their consent, is Article 6(1)(b) GDPR.

3. Recipients and duration of storage
The data will not be passed on to third parties and will be deleted every six months, unless longer storage is required for reasons of verifiability or legal retention obligations.

4. Right to object and have the matter rectified
The user has the right to withdraw their consent to the processing of their personal data at any time. If the user contacts us by email, they can object to the storage of their personal data at any time. In such a case, the order may not be processed. The objection should be sent to online-redaktion@bad-nauheim.de to address. All personal data stored during the contact process will be deleted in this case.

VII. Tourist Offers

1. Description and scope of data processing
On our website, you have the option to download brochures online, order printed brochures, or book accommodation. After selecting the brochures and number of brochures or choosing your accommodation, you will be redirected to the portal of our service provider, feratel media technologies GmbH.

2. Purpose of processing and legal basis
Data processing is carried out by feratel media technologies GmbH, Meßkircher Straße 17/2, 88605 Meßkirch, for the purpose of processing the order. The legal basis for this processing is Art. 6 para. 1 letter b) GDPR (purchase contract).

3. Recipients and duration of storage
The data is stored at feratel media technologies GmbH.

4. Right to object and have the matter rectified
Information on the processing of your personal data by feratel media technologies GmbH can be found at https://www.feratel.com/datenschutz.html.

VIII. Daycare pre-registration platform

1. Description and scope of data processing
On the City of Bad Nauheim's daycare pre-registration platform, you can register your childcare request for daycare and nursery care at a Bad Nauheim facility. The data you enter will be forwarded to our service provider, NOLIS GmbH.

2. Purpose of processing and legal basis
Data processing is carried out by NOLIS GmbH, Celler Straße 53, 31582 Nienburg. The legal basis for processing the data, if the user has given their consent, is Art. 6 para. 1 lit. a GDPR.

3. Recipients and duration of storage
The data is stored at NOLIS GmbH.

4. Right to object and have the matter rectified
Information on the processing of your personal data by NOLIS GmbH can be found at http://kita.bad-nauheim.de/portal/seiten/datenschutzerklaerung-900000001-12001.html.

IX. Booking portal Children's and Youth Office

1. Description and scope of data processing
You can book various activities on the booking platform of the Bad Nauheim Children's and Youth Office. The data you enter will be forwarded to our service provider, nupian GmbH.

2. Purpose of processing and legal basis
Data processing is carried out by nupian GmbH, Provinostr. 52, 86153 Augsburg. The legal basis for processing the data, if the user has given their consent, is Art. 6 para. 1 lit. a GDPR.

3. Recipients and duration of storage
The data is stored at nupian GmbH.

4. Right to object and have the matter rectified
Information on the processing of your personal data by nupian GmbH can be found at https://www.nupian.de/footer/datenschutz.

X. Waste collection calendar online

1. Description and scope of data processing
On the platform "bn.mein-abfallkalender.de" you can, among other things, subscribe to reminders for your waste collection dates or request bulky waste collection online. The data you enter will be forwarded to our service provider Know-iT solutions.

2. Purpose of processing and legal basis
Data processing is carried out by Know-iT solutions, Kurstraße 16, 61231 Bad Nauheim. The legal basis for processing the data, if the user has given their consent, is Art. 6 para. 1 lit. a GDPR.

3. Recipients and duration of storage
The data is stored at Know-iT solutions.

4. Right to object and have the matter rectified
Information on the processing of your personal data by Know-iT solutions can be found at https://bn.mein-abfallkalender.de/privacy-policy.

XI. Suggestion and Incident Management (Defect Reporter)

1. Description and scope of data processing
Using the AEM (Suggestion and Incident Management) system, you can quickly and easily report infrastructure issues that could be improved to the city administration. The data you enter will be forwarded to our service provider, Softplan Informatik GmbH.

2. Purpose of processing and legal basis
Data processing is carried out by Softplan Informatik GmbH, Herrngarten 14, 35435 Wettenberg. The legal basis for processing the data, if the user has given their consent, is Art. 6 para. 1 lit. a GDPR.

3. Recipients and duration of storage
The data is stored at Softplan Informatik GmbH.

4. Right to object and have the matter rectified
Information on the processing of your personal data by Softplan Informatik GmbH can be found at www.ingrada.de/datenschutzerklaerung.html.

XII. Measurement procedure („SZMnG“) of INFOnline GmbH (City Library – DBS)

Our website uses the measurement method („SZMnG“) of INFOnline GmbH (https://www.INFOnline.de) to determine statistical metrics about the use of our services. The aim of usage measurement is to statistically determine the number of visits to our website, the number of website visitors, and their browsing behavior – based on a uniform standard procedure – and thus obtain values that are comparable across the market.

1. Legal basis for processing
The measurement using the SZMnG measurement method by INFOnline GmbH is carried out with legitimate interest pursuant to Art. 6 para. 1 lit. f) GDPR.

The purpose of processing personal data is to compile statistics. These statistics serve to track and document the use of our services. Our legitimate interest arises from the economic value of the insights gained from the statistics and the market value of our website—also in direct comparison with third-party websites—which can be determined using these statistics.

Furthermore, we have a legitimate interest in providing the pseudonymized data to INFOnline GmbH and the University Library Centre of the State of North Rhine-Westphalia (hbz) for statistical purposes.

2. Type of data
INFOnline GmbH collects the following data, which is considered personal data under the GDPR:

  • IP address: On the internet, every device needs a unique address, the so-called IP address, to transmit data. The temporary storage of the IP address is technically necessary due to the way the internet functions. Before any processing, the IP addresses are shortened by one byte and only processed further in anonymized form. The unshortened IP addresses are neither stored nor processed further.
  • A randomly generated client identifier: For the purpose of recognizing computer systems, the usage measurement uses either a third-party cookie, a first-party cookie, a local storage object, or a signature created from various automatically transmitted information from your browser. This identifier is unique to a browser as long as the cookie or local storage object is not deleted. Therefore, data measurement and subsequent assignment to the respective client identifier is also possible when you visit other websites that also use the measurement method ("SZMnG") of INFOnline GmbH.
    The cookie's validity is limited to a maximum of 1 year.

3. Use of the data
The measurement method used on this website by INFOnline GmbH collects usage data. This is done to gather performance metrics such as page impressions, visits, and clients. The measured data is also used as follows:

  • So-called geolocation, i.e., the assignment of a website visit to the location of the visit, is based solely on the anonymized IP address and only down to the geographical level of federal states/regions. Under no circumstances can the geographical information obtained in this way be used to infer the specific location of a user.

4. Data retention period
INFOnline GmbH does not store the full IP address. The truncated IP address is stored for a maximum of 60 days. Usage data in conjunction with the unique identifier is stored for a maximum of 6 months.

5. Data transfer
Neither the IP address nor the shortened IP address will be shared.

6. Rights of the data subject
The data subject has the following rights:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to object (Art. 21 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18f. GDPR)
  • Right to data portability (Art. 20 GDPR)

For inquiries of this nature, please contact datenschutz@bad-nauheim.de. Please note that we must verify the identity of the person making such requests.

6. Right to object
If you do not wish to participate in the measurement, you can opt out via the following link: https://optout.ioam.de

To guarantee exclusion from tracking, it is technically necessary to set a cookie. If you delete the cookies in your browser, you will need to repeat the opt-out process using the link above.

The data subject has the right to lodge a complaint with a data protection authority.

Further information on data protection in the measurement process can be found on the website of INFOnline GmbH (https://www.infonline.de), which operates the measurement procedure.

XIII. Online Appointment Booking

1. Description and scope of data processing
Using the online appointment booking system, you can schedule an appointment with specific departments of the Bad Nauheim city administration. The data you enter will be forwarded to our service provider, Terminland GmbH.

2. Purpose of processing and legal basis
Data processing is carried out by Terminland GmbH, Kreuzberger Ring 44a, 65205 Wiesbaden. The legal basis for processing the data, if the user has given their consent, is Art. 6 para. 1 lit. a GDPR.

3. Recipients and duration of storage
The data is stored at Terminland GmbH.

4. Right to object and have the matter rectified
Information on the processing of your personal data by Terminland GmbH can be found at https://www.terminland.de/datenschutz.

XIV. Application and Processing Platform civento

1. Description and scope of data processing
Civento is an expandable digitization platform with a complete document management system and payment system integration for processing individual processes within the Bad Nauheim city administration, from application to internal processing and archiving. The data you enter will be forwarded to our service provider, ekom21 GmbH.

2. Purpose of processing and legal basis
Data processing is carried out by ekom21 GmbH, Carlo-Mierendorff-Straße 11, 35398 Gießen. The legal basis for processing the data, if the user has given their consent, is Art. 6 para. 1 lit. a GDPR.

3. Recipients and duration of storage
The data is stored by ekom21 GmbH.

4. Right to object and have the matter rectified
Information on the processing of your personal data by ekom21 GmbH can be found at https://www.ekom21.de/meta/datenschutzerklaerung/.

C. Rights of data subjects

If the legal requirements are met, you are entitled to the following rights under Articles 13(2), 15 to 22 of the GDPR.

I. Right to Information
You have the right, pursuant to Article 15 of the GDPR, to request information about your personal data processed by us. In particular, you can request information about the purposes of the processing, the categories of personal data, the categories of recipients to whom your data have been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the origin of your data if they were not collected by us, and the existence of automated decision-making, including profiling, and, where applicable, meaningful information about the logic involved. Please contact us directly. online-redaktion@bad-nauheim.de, if you wish to exercise your right to information.

II. Rectification, erasure, restriction of processing and data portability
Furthermore, if the legal requirements are met, you have the right to,

  • In accordance with Article 16 GDPR, you have the right to request the immediate rectification of inaccurate or incomplete personal data concerning you that we hold;
  • In accordance with Article 17 GDPR, you have the right to request the erasure of your personal data stored by us, unless processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defense of legal claims;
  • In accordance with Article 18 GDPR, you have the right to request the restriction of the processing of your personal data if you contest the accuracy of the data, the processing is unlawful but you oppose its erasure, we no longer need the data but you require it for the establishment, exercise or defense of legal claims, or you have objected to processing pursuant to Article 21 GDPR;
  • In accordance with Article 20 GDPR, you have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format or to request its transmission to another controller.

III. Right of objection
If your personal data is processed based on legitimate interests pursuant to Article 6(1)(f) GDPR, you have the right to object to the processing of your personal data pursuant to Article 21 GDPR, provided there are grounds relating to your particular situation or the objection is directed against direct marketing. In the latter case, you have a general right to object, which we will implement without requiring you to specify a particular situation. If you wish to exercise your right to withdraw consent or object, simply send an email to online-redaktion@bad-nauheim.de.

IV. Revocation of consent
You have the right to withdraw your consent to data processing at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

V. Supervisory Authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work, or the place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR. The supervisory authority with which the complaint has been lodged will inform the complainant of the progress and outcome of the complaint, including the possibility of a judicial remedy pursuant to Article 78 GDPR. The address of the supervisory authority responsible for the city of Bad Nauheim is: The Hessian Data Protection Commissioner, P.O. Box 3163, 65021 Wiesbaden, Germany, Email poststelle@datenschutz.hessen.de.

Further data protection declarations