Privacy notice
Data Protection Information
The following Privacy Notice provides information about the nature, scope and purposes of the processing of your personal data in connection with our online shop.
With this information, we fulfil our transparency obligations pursuant to Articles 12 and 13 of the General Data Protection Regulation (GDPR).
Controller
The controller within the meaning of the GDPR, the German Federal Data Protection Act (BDSG) and other applicable data protection provisions for this website is:
weimar GmbH
Marketing, Congress and Tourism Services Company
UNESCO-Platz 1
99423 Weimar
Phone: +49 (0) 3643 / 745-0
Email: tourist-info@weimar.de
Further information about our company and additional contact options can be found in our Legal Notice (Imprint).
Hosting
Provision of Our Website and Log Files
Description and Scope of Data Processing
Our website is hosted by an external service provider. We have concluded a data processing agreement with our web hosting provider.
Each time our website is accessed, the web server automatically collects the following information from your system:
- Website visited
- Date and time of access
- Amount of data transmitted (in bytes)
- Source/referrer from which you accessed the website
- Browser used
- Operating system used
- IP address
Legal Basis for Data Processing
The legal basis for the temporary storage of the above-mentioned data and its recording in so-called log files is our legitimate interest as the website operator pursuant to Article 6(1)(f) GDPR in conjunction with Section 25(2) No. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG), in ensuring the optimal provision of our online services.
Purpose of Data Processing
The temporary storage of your IP address by the web server is necessary to deliver the website to your device. For this purpose, your IP address must remain stored for the duration of your visit.
The storage of data in log files serves to ensure the security of our information technology systems (e.g. for detecting attacks). This data is not evaluated for marketing purposes.
Storage Period
The above-mentioned data will be deleted as soon as it is no longer required for the purposes for which it was collected. For data processed to provide the website, this is the case once your visit to the website has ended.
Data stored in log files will be deleted after no more than 14 days. Longer storage may occur in individual cases. In such cases, your IP address will be anonymised so that it can no longer be attributed to you personally.
Use of Cookies and Consent Services
Cookies
Description and Scope of Data Processing
We use cookies on our website. Cookies are text files stored on your device. They are either stored temporarily for the duration of a session (session cookies) or permanently (persistent cookies). Session cookies are automatically deleted at the end of your visit. Persistent cookies remain on your device until you delete them yourself or they are automatically removed by your web browser.
Legal Basis for Data Processing
The legal basis for the use of technically necessary cookies is our legitimate interest as the website operator pursuant to Article 6(1)(f) GDPR in conjunction with Section 25(2) No. 2 TDDDG.
The legal basis for setting third-party cookies that are not technically necessary but serve convenience functions is your consent pursuant to Article 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. You may withdraw your consent at any time. The lawfulness of data processing carried out before the withdrawal remains unaffected.
Purpose of Data Processing
Technically necessary cookies enable us to provide our website in a secure, error-free and user-friendly manner.
Technically unnecessary cookies provide additional convenience functions on our website, such as the provision of supplementary content and services.
Storage Period and Right to Object
Please refer to the cookie settings for the storage period of individual cookies.
You can delete stored cookies at any time via your browser settings or through the settings in the cookie consent area. You can also configure your browser to generally reject cookies from websites or third parties. Please note that disabling cookies may prevent you from using all functions of our website.
Cookie Consent
Description and Scope of Data Processing
This website uses cookie consent technologies to obtain your consent to the storage of certain cookies on your device or the use of certain technologies and to document this consent in compliance with data protection regulations.
When you interact with our cookie banner, the following personal data is processed:
- Your consent(s) or the withdrawal of your consent(s)
- Your anonymised IP address
- Information about your browser
- Information about your device
- Date and time of your visit to the website
Cookie consent technologies may store a cookie in your browser in order to associate your granted consent or its withdrawal with your browser. The data collected in this way is stored until you delete the cookie yourself, the cookie expires or the purpose for storing the data no longer applies.
Legal Basis for Data Processing
The documentation of your consent is required to fulfil our accountability obligations. The legal basis is Article 6(1)(c) GDPR in conjunction with Article 5(2) GDPR.
Contact Options
Contact by E-mail
Description and Scope of Data
Processing You may contact us using the e-mail addresses provided on our website. If you contact us, we process the personal data associated with your enquiry.
Legal Basis for Data Processing
The legal basis for processing your enquiry and the associated personal data is our legitimate interest pursuant to Article 6(1)(f) GDPR.
If your enquiry is aimed at concluding a contract, the legal basis for processing is the initiation or performance of a contract pursuant to Article 6(1)(b) GDPR.
Purpose of Data Processing
Your data is processed exclusively for the purpose of handling your enquiry.
Storage Period
Your data will be deleted as soon as it is no longer required for the purpose for which it was collected. For personal data transmitted by e-mail, this is the case when the respective correspondence with you has ended. Correspondence is deemed to have ended when it can be inferred from the circumstances that the matter in question has been conclusively resolved.
If your enquiry is related to the conclusion of a contract, statutory retention periods shall apply.
Right to Object
You may object to this data processing at any time. You can send your objection to the following e-mail address:
In this case, any personal data stored in the course of the correspondence will be deleted.
Payment Methods
Description and Scope of Data Processing
The companies commissioned by weimar GmbH to process payment transactions are not considered third parties within the meaning of the German Federal Data Protection Act (BDSG). They process data on our behalf and are contractually bound to comply with strict data protection requirements.
We use a secure connection for the transmission of payment data. No other personal information is disclosed to third parties. Your data will not be shared for any other non-commercial purposes.
Legal Basis for Data Processing
Your data is transferred for the purpose of processing payments in order to perform the contract in accordance with Article 6(1)(b) GDPR.
Further Information on Data Processing
Your data is processed on the basis of our legitimate interest in secure and efficient payment processing pursuant to Article 6(1)(f) GDPR, as well as for the performance of our contract with you pursuant to Article 6(1)(b) GDPR.
The data is processed on our behalf and in accordance with our instructions. The payment service providers are obliged to implement appropriate technical and organisational measures to protect your data.
Encrypted Payment Transactions
Where you provide payment details (e.g. account holder, bank account details, etc.) for the purpose of contract performance, such information is processed exclusively for payment processing.
Payment transactions are carried out via an encrypted SSL or TLS connection. You can recognise the use of such encryption by the "https://" prefix in your browser's address bar and the padlock symbol displayed next to the website address.
Your Rights as a Data Subject
If your personal data is processed by us in your capacity as a user or customer, you are considered a data subject within the meaning of the GDPR. As such, you have the following rights vis-à-vis the controller:
- Right of access (Article 15 GDPR)
- Right to rectification or erasure of personal data (Articles 16 and 17 GDPR)
- Right to restriction of processing (Article 18 GDPR)
- Right to be informed about the rectification or erasure of your personal data or the restriction of processing (Article 19 GDPR)
- Right to data portability (Article 20 GDPR)
- Right to withdraw consent previously given. The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal (Article 7(3) GDPR)
- Right to lodge a complaint with a supervisory authority (Article 77 GDPR)
Right to Object in Particular Cases (Article 21(1) GDPR)
Where the processing of your personal data is based on our legitimate interests pursuant to Article 6(1)(f) GDPR, you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data.
If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or unless the processing serves the establishment, exercise or defence of legal claims.
Right to Object to Direct Marketing (Article 21(2) GDPR)
Where your personal data is processed for direct marketing purposes, you have the right to object to such processing at any time.
If you object, your personal data will no longer be processed for direct marketing purposes.
External Links
Our website may contain links to third-party websites that are subject to their own data protection policies.
If you access such links and thereby enable third parties to process your personal data (e.g. your IP address), we have no influence over such processing and therefore cannot accept any responsibility for it.
Links to external digital services are indicated accordingly, either by symbols or by their textual presentation.
Security
Protecting your privacy is of the utmost importance to us. We therefore implement appropriate technical and organisational measures to protect your personal data against misuse, alteration and loss.
Data transmitted via our website is protected by an SSL or TLS certificate. You can recognise the use of such encryption by the "https://" prefix in your browser's address bar and the padlock symbol displayed next to the website address.
Despite carefully selected security measures, we would like to point out that complete protection cannot be guaranteed, particularly when transmitting data by e-mail or via our web forms.
Updates to this Privacy Notice
Our website is subject to ongoing technological developments associated with the operation and use of online services.
We therefore reserve the right to amend this Privacy Notice in line with changes to our security and data protection measures or to reflect any extended data processing activities, and to make the current version available on this website.