Privacy Policy

We take the protection of your personal data seriously. Personal data includes any information that can be linked to you personally, such as your name, address, email address, and your user behavior.

The purpose of this Privacy Policy is to inform you about the processing of your personal data that we collect when you visit our website.
 

Privacy Notice for Guest Card Holders

Privacy Notice for Job Applicants

 

I. Data Controller

The controller, as defined in Article 4(7) of the GDPR, is the entity that, alone or jointly with others, determines the purposes and means of the processing of personal data.

Tourismus-Zentrale St. Peter-Ording
, a municipal agency of the Municipality of St. Peter-Ording
, Maleens Knoll 2
, 25826 St. Peter-Ording

Phone: +49 4863 999-0
Fax: +49 4863 999-230
Email: info@spo-tz.de

 

II. Data Protection Officer

The Tourismus-Zentrale St. Peter-Ording has appointed a Data Protection Officer who can be contacted using the following contact information:

economed-Systemgruppe
Lars Bozenhardt
Dreierstr. 4
88131 Lindau

Mobile: +49 176 72978983
Email: lb@economed-gruppe.de

 

III. Website Operation and Log File Generation

Every visit to our website and every retrieval of a file stored on the website is logged in a so-called log file. This data is stored for internal system-related and statistical purposes.

The following data is recorded:

• Name of the accessed files, as well as the date and time of the server request,
• Amount of data transferred,
• Confirmation of successful retrieval,
• browser type and version, web browser and requesting domain,
• operating system used,
• logging of the IP address (hostname of the accessing computer),
• referrer URL (the previously visited page).

This data is stored in our system’s log files. This data is not stored together with any personal data belonging to a specific user, so individual site visitors cannot be identified.

Any additional personal data is collected only if you provide it voluntarily, for example, when you personally initiate contact, submit an inquiry, or register.

Legal Basis for Data Processing

The legal basis for the temporary storage of log files is Article 6(1)(f) of the GDPR. Our legitimate interest lies in ensuring that the purpose described below is achieved.

Purpose of data processing

The temporary (automated) storage of the IP address by the system is necessary to enable the website to be delivered to the user’s computer. For this purpose, the user’s IP address must remain stored for the duration of the session. The storage and processing of personal data in log files are carried out to ensure the functionality of the website. In addition, the data helps us optimize the website and generally ensure the security of our information technology systems.

Duration of Storage

The aforementioned technical data is deleted as soon as it is no longer needed to ensure the website’s compatibility for all visitors, but no later than 6 months after the website is accessed.

Right to Object and Right to Erasure

You may object to the processing at any time in accordance with Art. 21 of the GDPR and request the erasure of data in accordance with Art. 17 of the GDPR. You can find information about your rights and how to exercise them in this Privacy Policy under Section IX.

 

IV. Use of Cookies

Scope of Personal Data Processing

Our website uses cookies to enable certain functions and to integrate external web services. “Cookies” are small text files that are stored in or by the web browser on the user’s computer system. These text files contain a unique string of characters that uniquely identifies the browser when you return to our website.

We use cookies to make our website more user-friendly. Some elements of our website require that the browser accessing the site can be identified even after a page change. In the technically necessary elements, data such as “language” or “items in the shopping cart” are processed for the purpose of carrying out or facilitating electronic communication and providing an information society service requested by the user.

The user data collected in this manner is pseudonymized through technical measures. The data is not stored together with any other personal data of the users. 

In addition, we use cookies on our website that enable us to analyze users’ browsing behavior. 
For statistical analysis—that is, the processing and presentation of data regarding user actions and interactions on websites and apps—we use, for example, data on the number of page views, the number of unique visitors, the number of returning visitors, entry and exit pages, time spent on the site, bounce rate, button clicks, and, where applicable, the categorization of users into groups based on technical data regarding software settings (e.g., browser type, operating system, language setting, screen resolution) are stored and transmitted.
For audience measurement—that is, the evaluation of visitor activity through the analysis of usage behavior to identify specific user actions and measure the effectiveness of online advertising—the number of visitors who have arrived on websites or apps, for example, by clicking on advertisements, is measured. In addition, the rate of users who perform a specific action (e.g., subscribing to a newsletter, ordering goods) can be measured.

You can configure your browser to notify you when cookies are set and to allow cookies only on a case-by-case basis, to block cookies in specific cases or generally, and to enable the automatic deletion of cookies when you close your browser. Disabling cookies may limit the functionality of our website.

For more information on our use of cookies, please refer to Section IX of this Privacy Policy.

Legal Basis for Data Processing

To the extent that cookies are processed on the basis of consent pursuant to Art. 6(1)(a) of the GDPR, this consent also constitutes consent within the meaning of § 25(1) of the TDDDG for the placement of cookies on the user’s device.

To the extent that another legal basis under the GDPR is specified (e.g., for the performance of a contract or to comply with legal obligations), the storage or placement of cookies is based on an exception pursuant to Section 25(2) of the TDDDG. This exception applies “if the sole purpose of storing information on the end user’s terminal device or the sole purpose of accessing information already stored on the end user’s terminal device is to carry out the transmission of a message via a public telecommunications network” or “if the storage of information in the end user’s terminal equipment or access to information already stored in the end user’s terminal equipment is absolutely necessary for the provider of a telemedia service to be able to provide a telemedia service expressly requested by the user.”

The applicable legal basis is determined by the cookie table provided later in this section.

Purpose of Data Processing

The purpose of using technically necessary cookies is to simplify the use of websites for users. Some features of our website cannot be provided without the use of cookies. For these features, it is necessary for the browser to be recognized even after a page change.

The user data collected by technically necessary cookies is not used to create user profiles.

Analytics cookies are used to improve the quality of our website and its content. These cookies help us understand how the website is used, allowing us to continuously optimize our offerings.

Storage Duration

Our cookies are stored until you delete them from your browser or, in the case of a session cookie, until the session expires. 

Option to Object and Delete

You can configure your browser according to your preferences to generally prevent cookies from being set. Cookies serve various purposes, such as recognizing that your device is already connected to our website (persistent cookies) or saving recently viewed content (session cookies). If you have expressly granted us permission to process your personal data, you may revoke this consent at any time. Please note, however, that this does not affect the lawfulness of the processing carried out on the basis of your consent up until the time of revocation.

 

V. Online Withdrawal Function (“Withdrawal Button”)

Scope of Personal Data Processing

When you use the online withdrawal function (“Withdraw from Contract”) on our website, we process the data you enter in the withdrawal form. This includes, in particular, your name, your email address, and order and item numbers. In addition, the date and time of receipt of your withdrawal are logged to provide proof of receipt.

Purpose of data processing

The data is processed for the purpose of receiving, processing, and documenting your cancellation, as well as for sending an automated confirmation of receipt to the email address you provided.

Legal basis for data processing

The legal basis is Article 6(1)(c) of the GDPR (compliance with a legal obligation) and—to the extent that processing is necessary for the implementation of pre-contractual measures or for the performance of the contractual relationship—Article 6(1)(b) of the GDPR.

Recipients / Disclosure of Data

The data is processed within the Tourismus-Zentrale St. Peter-Ording by the relevant departments. If service providers (e.g., hosting or email service providers) are used to send the confirmation of receipt or to technically provide the form, this is done within the framework of commissioned processing in accordance with Article 28 of the GDPR.

Duration of Storage

We store the data transmitted via the online revocation function for as long as necessary to process and document the revocation. In addition, data may be stored to comply with statutory retention obligations and to assert, exercise, or defend legal claims. The specific retention period is determined by the applicable statutory time limits.

Right to Object and Right to Erasure

To the extent that processing is based on Article 6(1)(b) or (c) of the GDPR, there is no right to object under Article 21 of the GDPR. In all other respects, the data subject rights described in this Privacy Policy (in particular Articles 15 through 18 of the GDPR) apply, as well as your right to withdraw any consent you have given with future effect.

If cookies have been set based on your consent, you can withdraw your consent at any time in the cookie settings of the cookie banner. You can adjust the cookie settings here.

 

VI. Email Contact

Your personal data is protected by technical and organizational measures during collection, storage, and processing so that it is not accessible to third parties. In the case of unencrypted email communication, we cannot guarantee full data security during transmission to our IT systems. Therefore, for highly confidential information, we recommend encrypted communication or sending it by mail.

Scope of Personal Data Processing

All incoming and outgoing emails are archived in accordance with statutory retention requirements.

Legal basis for data processing

The legal basis is Article 6(1)(c) of the GDPR. The legal obligation consists of compliance with tax and commercial law requirements; see Sections 146 and 147 of the German Fiscal Code (AO) and Sections 238 and 257 of the German Commercial Code (HGB).

Purpose of data processing

The purpose of archiving is to comply with tax law requirements—see Sections 146 and 147 of the German Fiscal Code (AO) (obligation to retain emails relevant to tax matters)—and commercial law requirements, see Sections 238, 257 of the German Commercial Code (HGB) (obligation to archive business correspondence).

Duration of Storage

Our email correspondence is stored until the expiration of tax and commercial law retention obligations. The retention period may be up to 10 years.

Right to Object and Request Deletion

You may object to the processing at any time pursuant to Art. 21 of the GDPR and request the erasure of data pursuant to Art. 17 of the GDPR. You can find information on your rights and how to exercise them in this Privacy Policy under Section IX.

 

VII. Various Features

Our website offers you various features; when you use them, we collect, process, and store personal data. You can find out what happens to this data here:

1. Registration of a User Account

Notwithstanding Section 1, feratel is solely responsible for data processing in connection with orders in the online store, and TAC is responsible for the gift card store.

feratel media technologies GmbH
P.O. Box 1135
D-88602 Meßkirch
Tel: +49 7575 9210-0

TAC | The Assistant Company
Schildbach 111
A-8230 Hartberg
Tel: +43 506080 900

Scope of Personal Data Processing

The data entered during registration is processed by feratel or TAC to fulfill the purpose stated below.

Legal basis for data processing

The legal basis is Article 6(1)(b) of the GDPR, which provides for the implementation of (pre)contractual measures.

Purpose of Data Processing

The necessary data is processed for the purpose of establishing and carrying out the user relationship.

Retention period

The personal data processed in connection with your user account will be stored until the user account is deleted. After a user account is deleted, personal data may still be stored for up to three years for the purpose of asserting or defending legal claims relating to the respective users (Article 6(1)(f) of the GDPR).

Right to Object and Right to Erasure

You can find information about your rights and how to exercise them in this Privacy Policy under Section IX.

Requirement to Provide Personal Data

Providing certain personal data is required for registration. Without providing the required data, it is not possible to create a user account.

2. Order Form

What personal data is collected, and to what extent is it processed?

The data you enter into the form fields—such as your name, address, etc.—is processed by us to fulfill the purpose stated below.

Legal basis for data processing

The legal basis is Article 6(1)(b) of the GDPR, which provides for the implementation of (pre)contractual measures.

Purpose of data processing

The purpose of data processing is to process your order so that we can handle potential contractual relationships with you or carry out pre-contractual measures.

Retention period

The data will be deleted as soon as it is no longer needed to process the order and there are no longer any statutory retention requirements. This will generally be after 10 years; see Section 147(3) in conjunction with (1)(1), (4), and (4a) of the German Fiscal Code (AO) and Section 14b(1) of the German Value-Added Tax Act (UStG).

Right to Object and Right to Erasure

You can find information about your rights and how to exercise them in this Privacy Policy under Section IX.

Requirement to Provide Personal Data

The information requested in the order form is not required by contract or by law, but is necessary to conclude a contract. If you do not fill out the required fields or do not fill them out completely, the order you have requested cannot be completed.

3. Booking Request Form

What personal data is collected, and to what extent is it processed?

We will process the data you enter in our booking request form (date, number of people, etc.) to fulfill the following purpose.

Legal basis for data processing

The legal basis is Article 6(1)(b) of the GDPR, which provides for the implementation of (pre)contractual measures.

Purpose of Data Processing

The pre-contractual exchange of information is necessary to review your booking so that we can prepare for a possible future conclusion of a contract.

Retention Period

The data will be deleted as soon as it is no longer needed to process the booking and there are no longer any legal retention requirements.

Right to Object and Right to Erasure

You can find information about your rights and how to exercise them in this Privacy Policy under Section IX.

Requirement to Provide Personal Data

The information requested in the booking request form is not required by contract or by law, but it is necessary for us to process your booking properly. If you do not fill out the required fields—or do not fill them out completely—we will not be able to process your booking request.

4. Contact Form

What personal data is collected, and to what extent is it processed?

We will process the data you enter in the input fields of our contact form to fulfill the purpose stated below.

Legal basis for data processing

In the case of consent, the legal basis for processing is Article 6(1)(a) of the GDPR, whereby this consent is given through a clear affirmative action or behavior.

Purpose of Data Processing

We process the personal data from the input form solely to handle your inquiry or to initiate a contractual relationship.

Retention Period

Once your inquiry has been processed, the collected data will be deleted immediately, provided there are no statutory retention periods.

Right to Withdraw Consent and Request Deletion

The options for withdrawal and deletion are governed by the general provisions regarding the right to withdraw consent and the right to deletion under data protection law, as described later in this Privacy Policy.

Requirement to Provide Personal Data

The use of the contact forms is voluntary and is not required by contract or by law. You are not obligated to contact us via the contact form; instead, you may also use the other contact options listed on our website. If you wish to use our contact form, you must fill out the fields marked as required. If you do not provide the necessary information in the contact form, you will not be able to submit your request.

5. Newsletter Sign-Up Form

What personal data is collected, and to what extent is it processed?

On our website, you have the option to subscribe to a free newsletter. When you sign up, we receive the email address you entered in the sign-up field and, if applicable, additional contact information, provided you share it with us via the newsletter sign-up form.

Legal basis for data processing

The legal basis for processing data following a user’s newsletter registration is Article 6(1)(a) of the GDPR, provided the user has given consent via the double opt-in process.

As part of the double-opt-in process, you will then receive an email from us asking you to confirm your registration by clicking on the link provided in the email. This process serves as proof that you are the owner of the email address provided during registration and that you have consented to receiving the newsletter. In doing so, we store the date and time of your confirmation as well as your IP address. The legal basis for storing this data is our legal obligation to document your consent in accordance with Article 6(1)(c) of the GDPR and Article 7(1) of the GDPR.

Purpose of Data Processing

We use the data collected in our newsletter sign-up form exclusively to send our newsletter, in which we provide information about news and event recommendations from St. Peter-Ording and the Eiderstedt Peninsula, new products in the SPO Fan Shop, the “Podcast “Deichmomente””, and potential lodging reservations.

Retention Period

You can unsubscribe from our newsletter at any time by clicking the unsubscribe link, which is included in every newsletter. We will delete your data immediately after you unsubscribe. Likewise, we will delete your data immediately if your registration is not completed. We reserve the right to delete your data without providing reasons and without prior or subsequent notice.

Right to Withdraw Consent and Right to Erasure

You may withdraw your consent at any time in accordance with Art. 7(3) of the GDPR. However, this does not affect the processing that took place up until the time of withdrawal. For further rights, please refer to this Privacy Policy.

Requirement to Provide Personal Data

If you wish to subscribe to our newsletter, you must fill out the fields marked as required and confirm your email address by clicking the double-opt-in link. The information required for newsletter registration is neither necessary to enter into a contract with us nor required by law. It is used exclusively for the purpose of sending our newsletter. If you do not provide the required information, we unfortunately cannot provide you with our newsletter service.

 

VIII. Use of Company Profiles on Social Media

We maintain a corporate presence on the following social media platforms:

Facebook, Instagram, and Threads: Meta Platforms Ireland Limited, Dublin, Ireland

TikTok: TikTok Technology Limited, Dublin, Ireland

YouTube: Google Ireland Limited, Dublin, Ireland

LinkedIn: Ireland Unlimited Company, Dublin, Ireland

To ensure that data transfers to third countries are as privacy-friendly as possible, standard contractual clauses pursuant to Article 46(2)(c) of the GDPR have been concluded with providers in non-safe third countries. A copy of the standard data protection clauses can be requested by sending an informal email to info@tz-spo.de.

The legal basis for processing the data we collect in connection with the use of our corporate website is Article 6(1)(f) of the GDPR. If the contact is aimed at entering into a contract, the additional legal basis for the processing is Article 6(1)(b) of the GDPR. You may object at any time to the processing of your personal data that we collect in connection with your use of our corporate presence and exercise your data subject rights as outlined in Section X of this Privacy Policy. To do so, please send us an informal email to info@tz-spo.de.

If you engage in any activity on our Facebook, Instagram, YouTube, or LinkedIn corporate pages (such as comments, posts, or likes), you may thereby make personal data (e.g., your real name or profile photo) publicly available. Since we generally have no direct influence over the processing of your personal data by the companies jointly responsible for our corporate pages, we cannot provide you with binding information regarding the purpose and scope of this data processing.

You can find more information on how to object to or have your data removed by the social media providers here:

• Facebook: https://de-de.facebook.com/privacy/policy/
• Instagram: instagram.com/about/legal/privacy/
• Threads: https://help.instagram.com/515230437301944/?helpref=uf_share
• TikTok: https://www.tiktok.com/legal/page/eea/privacy-policy/de
• YouTube: https://policies.google.com/privacy
• LinkedIn: https://de.linkedin.com/legal/privacy-policy

 

IX. Tools and Plugins

1. Use of Google Analytics 4

We use Google Analytics 4 on our website, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics 4 uses so-called “cookies.” These are text files that are stored on your computer and enable an analysis of how the website is used. The information generated by the cookies regarding your use of this website is generally transmitted to a Google server in the United States and stored there.

However, please note that Google Analytics 4 does not store individual IP addresses. In addition, IP address anonymization is enabled by default in Google Analytics 4. This means that Google truncates users’ IP addresses within member states of the EU/EEA. Only in exceptional cases is the full IP address transmitted to a Google server in the United States and truncated there.

For more information on how Google Analytics handles user data, please see Google’s Privacy Policy: https://support.google.com/analytics/answer/6004245?hl=de

What personal data is collected, and to what extent is it processed?

By using Google Analytics, we analyze, among other things, the origin of visitors, the length of time they spend on individual pages, and their use of search engines. This allows us to better evaluate the success of our advertising campaigns. Furthermore, this enables us to evaluate the use of our website in order to compile reports on your activities and to use other Google services related to the use of our website and internet usage. A cookie is placed on your computer for this purpose. This allows the following personal data, among other things, to be stored and analyzed:

• the user’s activity (in particular, which pages were visited and which elements were clicked on);
• device and browser information (in particular, the IP address and operating system);
• data about the ads displayed (in particular, which ads were shown and whether the user clicked on them); and
• data from advertising partners (in particular, pseudonymized user IDs).