Privacy Policy

This English version is provided for your convenience. In the event of any discrepancy, the German version of this privacy policy shall prevail.

Controller within the meaning of the General Data Protection Regulation (GDPR):

Oldiefreunde Pfronten e.V.
König-Ludwig-Weg 26
87459 Pfronten
Germany

Phone: +49 8363 92083
Email: info@pfronten-gamsbartrallye.de
Website: https://www.oldiefreunde-pfronten.de/

Authorised representative(s): Norbert Schaller

A data protection officer is not required for our company according to Art. 37 GDPR and Section 38 BDSG. For questions regarding data protection, please contact the controller using the contact details provided above.

3.1 Scope of the processing of personal data

As a matter of principle, we process personal data of our users only to the extent necessary to provide a functional website as well as our content and services. Personal data is regularly processed only with the user's consent. An exception applies where obtaining prior consent is not possible for factual reasons and the processing of the data is permitted by law.

3.2 Legal bases for processing

Where we obtain consent for the processing of personal data, Art. 6(1)(a) GDPR serves as the legal basis.

Where the processing of personal data is necessary for the performance of a contract, Art. 6(1)(b) GDPR serves as the legal basis. This also applies to processing operations required to take steps prior to entering into a contract.

Where the processing of personal data is necessary to comply with a legal obligation, Art. 6(1)(c) GDPR serves as the legal basis.

Where the processing is necessary for the purposes of the legitimate interests of our company or of a third party, and the interests, fundamental rights and freedoms of the data subject do not override those interests, Art. 6(1)(f) GDPR serves as the legal basis for the processing.

4.1 Cookies and consent management

This website uses cookies. Cookies are text files that are stored in the web browser on your computer. They serve to make our services more user-friendly.

Legal bases:

• Technically necessary cookies: Section 25(2) No. 2 TDDDG (no consent required), Art. 6(1)(f) GDPR – our legitimate interest lies in providing a functional website.
• Analytics cookies: Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR (consent required)
• Marketing cookies: Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR (consent required)

You can change or withdraw your cookie settings at any time via the "Cookie settings" link in the footer of the website. Your consent decision is recorded both locally in your browser and on our server in order to meet the accountability obligation under Art. 7(1) GDPR.

Retention period of cookie consents: 1 year

4.2 Server log files

The provider of these pages automatically collects and stores information in server log files that your browser automatically transmits to us:

• Browser type and browser version
• Operating system used
• Referrer URL (previously visited page)
• Host name of the accessing computer
• Time of the server request
• IP address (anonymised where applicable)

Legal basis: Art. 6(1)(f) GDPR

Legitimate interest: The collection of this data is technically necessary to provide the website, to ensure system security and to detect attacks on our servers.

Retention period: The data is deleted after 7 days at the latest, unless longer storage is required for security reasons (e.g. to investigate an attack).

This data is not merged with other data sources.

4.3 Contact form and email enquiries

If you send us enquiries via the contact form or by email, your details, including the contact details you provide, will be stored by us for the purpose of processing the enquiry and in case of follow-up questions.

Data processed:

• Name
• Email address
• Phone number, if provided
• Your message/enquiry
• Time of the enquiry

Legal basis:

• For enquiries related to a contract or pre-contractual measures: Art. 6(1)(b) GDPR
• For general enquiries: Art. 6(1)(f) GDPR – our legitimate interest lies in answering your enquiries and communicating with prospective and existing customers.

Retention period: The data is deleted as soon as it is no longer required for the purpose for which it was collected. For contact enquiries, this is generally the case when the respective conversation has ended and no statutory retention obligations apply. As a rule, the data is deleted after 3 years, provided that no retention obligations exist.

We do not pass on this data without your consent.

4.4 Registration and user account

You can create a user account on our website. The data entered during registration is used for the use of the service.

Data processed:

• Email address
• Password (stored in encrypted form)
• Any further data entered in the registration form

Legal basis: Art. 6(1)(b) GDPR (performance of a contract)

Retention period: The data is stored for as long as the user account exists. After the account has been deleted, the data is deleted unless statutory retention obligations apply.

Necessity of the data: Providing the data marked with an asterisk (*) is required for registration. If this data is not provided, no user account can be created.

5.1 Scope of data processing

Applications for events can be submitted via this website. The following data is collected in this process:

• Company data (company name, contact person)
• Contact details (address, phone, email)
• Application-specific data (category, booth size, service requirements)
• Uploaded documents

Legal basis: Art. 6(1)(b) GDPR (initiation and performance of a contract)

Necessity of the data: Providing the data marked as mandatory fields is required to process the application. Without this data, the application cannot be processed.

5.2 Retention period

Application data is stored for the duration of the application process.

• Rejected applications: deleted after 6 months (Art. 6(1)(f) GDPR – legitimate interest in defending against possible legal claims)
• Accepted applications: stored for the duration of the contractual relationship plus the statutory retention periods (up to 10 years pursuant to Section 147 AO)

We use the following service providers, who process personal data on our behalf:

6.1 Hosting and infrastructure

Service provider: Bavamont Limited
Purpose: Web hosting, operation of the website and databases
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in reliable website operation)
Server location: Deutschland

Some of our service providers are based in third countries outside the European Union or the European Economic Area (EEA).

7.1 USA

Personal data is transferred to US companies on the basis of the adequacy decision of the EU Commission of 10 July 2023 (EU-US Data Privacy Framework), provided that the respective service provider is certified under the Data Privacy Framework.

For service providers not covered by the Data Privacy Framework, we base the transfer on EU standard contractual clauses pursuant to Art. 46(2)(c) GDPR as well as supplementary technical and organisational safeguards.

7.2 Other third countries

Where data is transferred to other third countries for which there is no adequacy decision of the EU Commission, the transfer is based on EU standard contractual clauses (Art. 46(2)(c) GDPR) or other appropriate safeguards pursuant to Art. 46 GDPR.

You can request information about the respective safeguards from us using the contact details provided above.

We only store your data for as long as is necessary for the respective purposes or as required by statutory retention obligations:

You have the following rights with regard to personal data concerning you:

9.1 Right of access (Art. 15 GDPR)

You have the right to obtain confirmation as to whether we process personal data concerning you. If this is the case, you have the right of access to this data and to further information pursuant to Art. 15 GDPR.

9.2 Right to rectification (Art. 16 GDPR)

You have the right to request the rectification of inaccurate personal data or the completion of incomplete personal data.

9.3 Right to erasure (Art. 17 GDPR)

You have the right to request the erasure of your personal data, provided that the conditions of Art. 17 GDPR are met.

9.4 Right to restriction of processing (Art. 18 GDPR)

You have the right to request the restriction of the processing of your data if one of the conditions of Art. 18 GDPR applies.

9.5 Right to data portability (Art. 20 GDPR)

You have the right to receive the personal data concerning you in a structured, commonly used and machine-readable format and to transmit this data to another controller.

9.6 Right to withdraw consent (Art. 7(3) GDPR)

Where the processing is based on consent, you have the right to withdraw this consent at any time. The withdrawal does not affect the lawfulness of the processing carried out on the basis of the consent before its withdrawal.

9.7 Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

You have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data infringes the GDPR.

Exercising your rights: To exercise your rights, please use the GDPR functions in your user account (data export, account deletion) or contact us directly using the contact details provided above.

No automated decision-making, including profiling within the meaning of Art. 22(1) and (4) GDPR, takes place that produces legal effects concerning you or similarly significantly affects you.

Should this change, we will inform you separately about the logic involved as well as the significance and the envisaged consequences of such processing.

12.1 SSL/TLS encryption

For security reasons and to protect the transmission of confidential content, this site uses SSL/TLS encryption. You can recognise an encrypted connection by the browser's address bar changing from "http://" to "https://" and by the lock symbol in your browser bar.

If SSL/TLS encryption is activated, the data you transmit to us cannot be read by third parties.

12.2 Technical and organisational measures

We use technical and organisational security measures to protect your data against accidental or intentional manipulation, loss, destruction or access by unauthorised persons. Our security measures are continuously improved in line with technological developments.

You have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data.

A list of the data protection supervisory authorities in Germany can be found at: https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html

If you have questions about the collection, processing or use of your personal data, or regarding information, rectification, restriction or erasure of data, the withdrawal of consent given or an objection to a particular use of data, please contact:

Oldiefreunde Pfronten e.V.
König-Ludwig-Weg 26
87459 Pfronten
Email: info@pfronten-gamsbartrallye.de
Phone: +49 8363 92083

We reserve the right to amend this privacy policy so that it always complies with current legal requirements or to reflect changes to our services in the privacy policy, e.g. when introducing new services.

The new privacy policy will then apply to your next visit. Registered users will be informed by email of any material changes.