Privacy Polisy

1. Controller


The controller responsible for the processing of personal data on this website is:
EXITROOM GmbH
Gerlachstraße 39
14480 Potsdam
Germany
Email: info@exitroom.de
Telephone: +49 30 544527950


2. Data Protection Officer

EXITROOM GmbH has appointed an external data protection officer.
You can contact the data protection officer at:
Email: info@exitroom.de
Subject: “Data Protection Officer”
Enquiries bearing this subject line will be forwarded to the data protection officer.


3. General Information on Data Processing

We process personal data only to the extent necessary to provide and secure this website, process enquiries, handle bookings, comply with legal obligations or on the basis of valid consent.
Personal data means any information relating to an identified or identifiable natural person. This includes, for example, names, contact details, IP addresses, booking data and information about the use of our website.
The following legal bases apply in particular to the processing:
* Article 6(1)(a) GDPR, where you have given your consent;
* Article 6(1)(b) GDPR, where processing is necessary for the performance of a contract or in order to take steps prior to entering into a contract;
* Article 6(1)(c) GDPR, where we are required to comply with legal obligations;
* Article 6(1)(f) GDPR, where processing is necessary for the purposes of our legitimate interests or those of a third party and your interests, fundamental rights and freedoms do not override those interests.
Where information is stored on or accessed from your terminal equipment, this is carried out for strictly necessary operations on the basis of Section 25(2)(2) TDDDG. For operations that are not strictly necessary, we obtain your prior consent in accordance with Section 25(1) TDDDG.


4. Encrypted Data Transmission

This website uses TLS or SSL encryption. This protects data transmitted between your terminal equipment and our website against unauthorised interception while it is being transmitted.
You can identify an encrypted connection in particular by the fact that the website address begins with “https://”.


5. Provision of the Website and Server Log Files

When you access our website, the browser on your terminal equipment transmits technically necessary information to the servers used to provide the website.
The following data in particular may be processed:
- page or file accessed;
- date and time of access;
- volume of data transferred;
- referrer URL;
- browser type and browser version;
- operating system;
- IP address;
- hostname of the accessing terminal equipment;
- access status or HTTP status code.
The processing is carried out to deliver the website, ensure its stability and security, identify technical errors and prevent abusive access.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and technically error-free provision of our website.
Server log files are generally stored for no longer than seven days and then deleted. They may be stored for a longer period where this is necessary to investigate a specific security incident or to establish, exercise or defend legal claims. In such cases, the data concerned will be deleted once the matter has been concluded, provided that no statutory retention obligations prevent its deletion.


6. Hosting with Webflow

This website is created and provided using Webflow. The provider is:
Webflow, Inc.
398 11th Street, 2nd Floor
San Francisco, CA 94103
USA
In connection with the provision of the website, Webflow processes IP addresses, technical connection data, browser information, accessed content and, where applicable, data submitted through web forms.
The processing is necessary to provide the website, technically process forms and ensure the security and functionality of the website.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in the secure and reliable provision of our online services. Where data is processed to handle a specific enquiry or to prepare or perform a contract, Article 6(1)(b) GDPR is an additional legal basis.
Webflow processes some data on our behalf. Data may also be processed in the USA. Where a recipient is certified under the EU-US Data Privacy Framework, the transfer is based on the European Commission’s adequacy decision pursuant to Article 45 GDPR. In other cases, the transfer may be based in particular on the European Commission’s Standard Contractual Clauses pursuant to Article 46(2)(c) GDPR.
Further information:
https://webflow.com/legal/privacy


7. Cloudflare

We use services provided by the following company to ensure the secure and fast delivery of our website:
Cloudflare, Inc.
101 Townsend Street
San Francisco, CA 94107
USA
Cloudflare provides security, network and content delivery services in particular. In this context, the IP address, accessed address, date and time of access, browser information, referrer, device information and information about potential security events may be processed.
The processing serves to prevent attacks and abusive access and to ensure the stable and fast delivery of the website.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in the security, availability and performance of our website.
Cloudflare is certified under the EU-US Data Privacy Framework. Where its requirements are met, the transfer is based on the adequacy decision pursuant to Article 45 GDPR. The European Commission’s Standard Contractual Clauses may also be used.
Further information:
https://www.cloudflare.com/privacypolicy/


8. Contact and Contact Form

If you contact us using the contact form, by email or by telephone, we process the data you provide.
Depending on the nature of your enquiry, this may include in particular:
* name;
* email address;
* telephone number, if provided;
* subject;
* content of your message;
* date and time of submission;
* technical information relating to the submission.
The data is processed to respond to your enquiry and, where necessary, to communicate with you further.
Where your enquiry concerns a booking, an existing contract or steps prior to entering into a contract, the legal basis is Article 6(1)(b) GDPR. For other enquiries, the legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in the appropriate processing of business enquiries.
The contact form is technically provided through Webflow. The information entered may therefore be processed by Webflow on our behalf.
We delete enquiries once they have been fully dealt with and there are no statutory retention obligations or legitimate grounds requiring further storage. Business- or tax-related correspondence may be retained in accordance with statutory retention periods.
The information identified as mandatory is required so that we can process your enquiry. Without this information, the form cannot be submitted or the enquiry cannot be answered.


9. Cookies and Similar Technologies

Our website uses cookies and similar technologies such as local storage, pixels, tags and embedded content.
We distinguish between the following categories:
Necessary Services
Necessary services are required to provide the website securely, store your privacy settings or provide a function expressly requested by you, such as online booking or payment processing.
Where information is stored on or accessed from your terminal equipment for these purposes, this is carried out on the basis of Section 25(2)(2) TDDDG. Depending on the respective purpose, the subsequent processing of personal data is based on Article 6(1)(b), (c) or (f) GDPR.
Statistics
Statistics services help us understand how our website is used. These services are activated only if you have given your prior consent.
The legal bases are Section 25(1) TDDDG and Article 6(1)(a) GDPR.
Marketing
Marketing services are used in particular to measure advertising campaigns, perform conversion tracking and display interest-based advertising. These services are activated only if you have given your prior consent.
The legal bases are Section 25(1) TDDDG and Article 6(1)(a) GDPR.
External Media and Functions
These include, for example, Google Maps, Instagram content, review widgets and online chat. Activating these services may result in data being transmitted to the respective provider. These services are activated only if you have given your prior consent or expressly access the relevant function and confirm the processing required for it.
The legal bases are Section 25(1) TDDDG and Article 6(1)(a) GDPR.
Your consent is voluntary. As a general rule, you can also use the website without consenting to statistics, marketing and external media services.
You can change your selection or withdraw consent at any time using the “Cookie Settings” link available on the website. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
The cookie settings also contain up-to-date information about the cookies and similar technologies used, including their provider, purpose, category and storage duration.


10. Consent Management with Cookiebot

We use the Cookiebot by Usercentrics consent management platform on our website.
Cookiebot is used to obtain, manage and document your consent to the use of cookies and similar technologies. Cookiebot allows you to accept or reject specific categories of services and to withdraw previously granted consent at any time with effect for the future.
The following information in particular may be processed:
* consent decision;
* time of consent;
* consent ID;
* domain and URL;
* banner and template version;
* language setting;
* browser and device information;
* shortened or otherwise processed IP address.
Cookiebot sets a technically necessary cookie to store your consent decision and take it into account during subsequent visits to the website.
Storing and accessing the consent decision is necessary to save your selected privacy settings. The legal basis for accessing your terminal equipment is Section 25(2)(2) TDDDG. Personal data is processed to comply with our documentation and accountability obligations pursuant to Articles 5(2) and 7(1) GDPR on the basis of Article 6(1)(c) GDPR.
Consent data is stored for as long as necessary to provide evidence of the consent. The specific lifetime of the Cookiebot cookie stored on your terminal equipment is displayed in the cookie settings.
You can change or withdraw your selection at any time using “Cookie Settings”.
Further information:
https://www.cookiebot.com/en/privacy-policy/
https://usercentrics.com/privacy-policy/
11. Google Tag Manager and Google Consent Mode
We use Google Tag Manager and Google Consent Mode. The provider is:
Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland
Google Tag Manager is used to manage website tags. In particular, it is used to technically control analytics and marketing services. Google Consent Mode is used to communicate the consent status selected in the Cookiebot consent banner to Google services.
Non-essential Google services and analytics and marketing tags managed through Tag Manager are activated only after you have given your consent.
Technical information such as your IP address, browser information, device information, page accessed, referrer, time of access and consent status may be processed.
Where information is stored on or accessed from your terminal equipment, this is carried out on the basis of Section 25(1) TDDDG. Personal data is processed on the basis of Article 6(1)(a) GDPR.
Google may also process data in the USA. Google LLC is certified under the EU-US Data Privacy Framework. Where its requirements are met, the data transfer is based on Article 45 GDPR. Standard Contractual Clauses pursuant to Article 46(2)(c) GDPR may also be used.
Further information:
https://policies.google.com/privacy
https://business.safety.google/privacy/


12. Google Analytics

With your consent, we use Google Analytics to statistically evaluate the use of our website. The provider is:
Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland
Google Analytics helps us understand how visitors reach our website, which pages they access and how our services are used.
The following data in particular may be processed:
* IP address;
* device and browser information;
* approximate region;
* pages accessed;
* referrer;
* date and time of access;
* length of visit;
* interactions with the website;
* technical identifiers;
* cookie information.
The service is used exclusively on the basis of your consent pursuant to Section 25(1) TDDDG and Article 6(1)(a) GDPR.
Google may also process data in the USA. Google LLC is certified under the EU-US Data Privacy Framework. Where its requirements are met, the transfer is based on Article 45 GDPR. Standard Contractual Clauses may also be used.
The storage duration of the cookies and similar technologies used by Google Analytics is displayed in the cookie settings. You can withdraw your consent there at any time.
Further information:
https://policies.google.com/privacy
https://policies.google.com/technologies/partner-sites


13. Google Ads and Conversion Tracking

With your consent, we use Google Ads and Google Ads Conversion Tracking. The provider is:
Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland
Google Ads allows us to display advertisements in Google Search and the Google advertising network. Conversion tracking enables us to measure whether users perform specific actions on our website after clicking on or viewing an advertisement, such as accessing a booking page or completing a booking.
The following data in particular may be processed:
* IP address;
* browser and device information;
* pages accessed;
* referrer;
* date and time;
* advertising and cookie identifiers;
* information about advertisements displayed or clicked;
* information about actions performed on the website;
* consent status.
The service is used exclusively on the basis of your consent pursuant to Section 25(1) TDDDG and Article 6(1)(a) GDPR.
You can withdraw your consent at any time using “Cookie Settings”.
Google may also process data in the USA. Google LLC is certified under the EU-US Data Privacy Framework. Where its requirements are met, the transfer is based on Article 45 GDPR. Standard Contractual Clauses may also be used.
Further information:
https://policies.google.com/privacy
https://business.safety.google/privacy/


14. Meta Pixel

With your consent, we use the Meta Pixel. The provider for users in the European Economic Area is:
Meta Platforms Ireland Limited
Merrion Road
Dublin 4
D04 X2K5
Ireland
The Meta Pixel is used to measure the effectiveness of advertisements and create target audiences for advertisements. It enables us to determine whether users accessed specific pages or offers after clicking on or viewing an advertisement.
The following information in particular may be processed:
* IP address;
* browser and device information;
* page accessed;
* referrer;
* date and time of access;
* interactions with our website;
* technical identifiers;
* cookie information;
* information about advertisements and campaigns.
If you are logged in to Facebook or Instagram, Meta may be able to associate the information with your user account. Meta may process the data for its own advertising, analytics and personalisation purposes.
The service is used exclusively on the basis of your consent pursuant to Section 25(1) TDDDG and Article 6(1)(a) GDPR.
Where we jointly determine the purposes and means of processing with Meta, Meta’s arrangements concerning joint controllership also apply.
Meta may also process data in the USA and other third countries. Where the requirements of the EU-US Data Privacy Framework are met, the transfer is based on Article 45 GDPR. Standard Contractual Clauses may also be used.
You can withdraw your consent at any time using “Cookie Settings”.
Further information:
https://www.facebook.com/privacy/policy/
https://www.facebook.com/legal/controller_addendum


15. Google Maps

Our website uses a map function provided by:
Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland
Google Maps is loaded only after you have consented to processing for external media or the corresponding Cookiebot category.
After activation, information including your IP address, browser and device information, location information, page accessed, referrer, date and time may be transmitted to Google.
The legal bases are Section 25(1) TDDDG and Article 6(1)(a) GDPR.
By clicking on an external link to Google Maps, you leave our website. Google is responsible for the subsequent processing.
Google may also process data in the USA. Google LLC is certified under the EU-US Data Privacy Framework. Where its requirements are met, the transfer is based on Article 45 GDPR. Standard Contractual Clauses may also be used.
Further information:
https://policies.google.com/privacy


16. Instagram Content

Posts and videos from Instagram are embedded on our website. The provider is:
Meta Platforms Ireland Limited
Merrion Road
Dublin 4
D04 X2K5
Ireland
Embedded content is loaded only after you have consented to the corresponding Cookiebot category.
Once activated, a connection is established to Meta’s servers. Information including your IP address, browser and device information, page accessed, referrer, date and time and technical identifiers may be transmitted.
If you are logged in to Instagram, Meta may be able to associate your visit with your user account.
The legal bases are Section 25(1) TDDDG and Article 6(1)(a) GDPR.
Meta may also process data in the USA and other third countries. Where the requirements of the EU-US Data Privacy Framework are met, the transfer is based on Article 45 GDPR. Standard Contractual Clauses may also be used.
Further information:
https://privacycenter.instagram.com/policy/


17. Tidio Chat

We use a chat service provided by:
Tidio Poland Sp. z o.o.
Wojska Polskiego 81
70-481 Szczecin
Poland
as well as Tidio LLC, USA.
The chat allows you to communicate with us directly through our website. The chat is activated only after you have consented to the corresponding Cookiebot category.
When the chat is loaded and used, the following data in particular may be processed:
* IP address;
* browser and device information;
* date and time of access;
* page accessed;
* technical identifiers;
* chat history;
* contact information and content voluntarily provided.
The legal bases for activating the chat are Section 25(1) TDDDG and Article 6(1)(a) GDPR.
If you subsequently use the chat to take steps prior to entering into a contract or to deal with an existing booking, Article 6(1)(b) GDPR additionally applies to the processing of the messages you enter. For general enquiries, processing is additionally based on Article 6(1)(f) GDPR.
Tidio may also process data outside the European Union or European Economic Area. Where no adequacy decision applies, the transfer may be based in particular on the European Commission’s Standard Contractual Clauses.
Chat data is deleted once the enquiry has been dealt with and there are no statutory retention periods or legitimate grounds requiring further storage.
Further information:
https://www.tidio.com/privacy-policy/


18. ProvenExpert

We use a ProvenExpert widget or rich snippet on our website. The provider is:
Expert Systems AG
Germany
The widget is used to display or technically provide review information. It is loaded only after you have consented to the corresponding Cookiebot category.
Loading the widget may establish a connection to ProvenExpert. The IP address, browser and device information, page accessed, referrer, date and time may be processed in this context.
The legal bases are Section 25(1) TDDDG and Article 6(1)(a) GDPR.
You can withdraw your consent at any time using “Cookie Settings”.
Further information:
https://www.provenexpert.com/en-us/privacy-policy/


19. Google Web Fonts

Our website uses Google Web Fonts to ensure the consistent display of fonts. The provider is:
Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland
When the website is accessed, your browser may establish a connection to Google’s servers to load the required fonts and associated files. In this context, your IP address in particular may be transmitted to Google.
Where Google Web Fonts are loaded only after consent has been given, the legal bases are Section 25(1) TDDDG and Article 6(1)(a) GDPR.
Google may also process data in the USA. Google LLC is certified under the EU-US Data Privacy Framework. Where its requirements are met, the transfer is based on Article 45 GDPR. Standard Contractual Clauses may also be used.
Further information:
https://policies.google.com/privacy


20. Online Booking and Voucher Purchases via bookingkit

We use the booking system provided by the following company for online bookings and voucher purchases:
bookingkit GmbH
Sonnenallee 223
12059 Berlin
Germany
The bookingkit booking module is embedded on the booking page. When purchasing a voucher, you will be redirected to an order page provided by bookingkit.
In connection with a booking, bookingkit processes the information you enter in the relevant booking or order form. Depending on the booking, this includes in particular:
* name;
* address;
* email address;
* telephone number;
* service booked;
* number of participants;
* date and time;
* booking and voucher data;
* billing information;
* payment method;
* IP address and timestamp.
The data is processed to display available times, process and manage the booking, create and redeem vouchers, communicate about the booking, process payments and perform the contract concluded with you.
The legal basis is Article 6(1)(b) GDPR. Where data is retained to comply with commercial or tax law obligations, the legal basis is Article 6(1)(c) GDPR.
Where the booking module stores information on or accesses information from your terminal equipment that is technically necessary for the online booking expressly requested by you, this is carried out on the basis of Section 25(2)(2) TDDDG.
bookingkit processes some personal data on our behalf. Where bookingkit processes data for its own purposes, bookingkit provides information about this in its own privacy information.
Booking data is stored for as long as necessary to perform the contract. Invoices and tax-relevant data are stored in accordance with statutory retention periods. The data is subsequently deleted or its processing is restricted.
Further information:
https://bookingkit.com/privacy-policy/


21. Payment Processing via Stripe

Payments within the bookingkit booking process are processed via Stripe.
For users in the European Economic Area, the service is generally provided by Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. Depending on the specific payment method and processing operation, other Stripe group companies may also be involved.
If you select a payment method offered through Stripe, the data necessary to process the payment is transmitted to Stripe.
This may include in particular:
* name;
* billing address;
* email address;
* payment amount and currency;
* booking and transaction number;
* selected payment method;
* payment information;
* IP address;
* device and browser information;
* information for fraud prevention and payment confirmation.
The processing is necessary to carry out your selected payment and therefore to perform the contract. The legal basis is Article 6(1)(b) GDPR. Where data is processed to comply with legal obligations, this is carried out on the basis of Article 6(1)(c) GDPR.
Stripe processes certain data under its own responsibility under data protection law, in particular to process and secure payments, prevent fraud and comply with legal obligations. We do not have full control over this independent processing.
Stripe may also process data outside the European Union or European Economic Area. Depending on the relevant recipient, the EU-US Data Privacy Framework and the European Commission’s Standard Contractual Clauses may be used.
Stripe’s privacy information applies to the specific retention period at Stripe.
Further information:
https://stripe.com/en-de/privacy


22. Newsletter via Mailchimp

Customers who have placed an order through bookingkit can expressly consent to receiving our newsletter during the ordering process.
Subscription is voluntary. Completing a booking is not conditional upon your consent to receive the newsletter.
If you activate the relevant newsletter checkbox during the ordering process, we use your email address to send you information about our offers, promotions and news.
The legal basis for sending the newsletter is your consent pursuant to Article 6(1)(a) GDPR.
The newsletter is distributed through Mailchimp. Mailchimp is a service of the Intuit group of companies. The provider is in particular:
The Rocket Science Group LLC
d/b/a Mailchimp
675 Ponce de Leon Avenue NE
Suite 5000
Atlanta, Georgia 30308
USA
The following data in particular may be transmitted to and processed by Mailchimp for newsletter distribution:
* email address;
* consent status;
* time and source of subscription;
* technical sending and delivery information.
We have disabled the personal evaluation of newsletter opens and link clicks. We therefore do not use Mailchimp to create individual usage profiles concerning the reading or clicking behaviour of newsletter recipients.
Mailchimp may also process data in the USA. Where a recipient is certified under the EU-US Data Privacy Framework, the transfer is based on the European Commission’s adequacy decision pursuant to Article 45 GDPR. The European Commission’s Standard Contractual Clauses may also be used.
You can withdraw your consent at any time with effect for the future. You may do so in particular by using the unsubscribe link at the end of each newsletter or by contacting us at info@exitroom.de.
After you unsubscribe, your email address will be removed from the active newsletter distribution list. Where necessary to provide evidence of previously granted consent, comply with an objection to advertising or defend against legal claims, the necessary evidence may be retained for the duration of the applicable statutory limitation periods. The data will no longer be used to send newsletters during this period.
Further information:
https://www.intuit.com/privacy/statement/
https://mailchimp.com/legal/privacy/


23. External Links and Social Media Profiles

Our website contains links to external services, including Instagram, Facebook, TikTok, LinkedIn, Tripadvisor and Google Maps.
In the case of simple links, we do not transmit any data to the respective provider. Only when you click the link do you leave our website and establish a direct connection to the respective provider.
The respective provider is responsible for the subsequent processing of personal data. The privacy information of the relevant service applies.


24. Recipients of Personal Data

In connection with the processing activities described, personal data may be transmitted in particular to the following categories of recipients:
* hosting, CDN and security service providers;
* website and form system providers;
* booking and voucher platforms;
* payment service providers;
* IT and communication service providers;
* newsletter distribution service providers;
* analytics, marketing and media services following your consent;
* tax advisers, auditors or legal advisers, where necessary;
* authorities and public bodies, where required by law.
Where service providers process personal data exclusively on our behalf, they are engaged on the basis of an agreement pursuant to Article 28 GDPR.


25. Transfers of Data to Third Countries

Some of the service providers we use are established outside the European Union or European Economic Area or use subcontractors located there.
Data is transferred only where the requirements of Articles 44 to 49 GDPR are met.
These safeguards include in particular:
* an adequacy decision by the European Commission pursuant to Article 45 GDPR, particularly where there is valid certification under the EU-US Data Privacy Framework;
* the European Commission’s Standard Contractual Clauses pursuant to Article 46(2)(c) GDPR;
* additional technical or organisational safeguards, where required;
* a statutory derogation under Article 49 GDPR in an individual case.
You can request information about the safeguards applicable in each case by contacting info@exitroom.de.


26. Storage Duration

Unless a specific storage duration is stated in the individual sections, we store personal data only for as long as necessary for the relevant purpose.
The data is subsequently deleted unless statutory retention obligations, ongoing contractual relationships or legitimate grounds require further storage.
Business- and tax-related documents are stored in accordance with statutory retention periods. Data required to establish, exercise or defend legal claims may be retained until the applicable statutory limitation periods have expired.
If deletion is not yet permitted due to legal obligations, the data will be blocked from other processing.


27. Requirement to Provide Personal Data

As a general rule, you are under neither a statutory nor contractual obligation to provide us with personal data through this website.
However, certain data is required so that we can process an enquiry, make a booking, process a payment or perform a contract. Without the information identified as required, the relevant service cannot be provided or cannot be provided in full.
Consent to statistics, marketing and external media services and to newsletter distribution is voluntary.


28. Automated Decision-Making

In connection with this website, we do not make any decisions based solely on automated processing within the meaning of Article 22 GDPR that produce legal effects concerning you or similarly significantly affect you.


29. Your Rights

Subject to the applicable statutory requirements, you have the following rights in particular:
* right of access pursuant to Article 15 GDPR;
* right to rectification pursuant to Article 16 GDPR;
* right to erasure pursuant to Article 17 GDPR;
* right to restriction of processing pursuant to Article 18 GDPR;
* right to data portability pursuant to Article 20 GDPR;
* right to object pursuant to Article 21 GDPR;
* right to withdraw consent pursuant to Article 7(3) GDPR;
* right to lodge a complaint with a data protection supervisory authority pursuant to Article 77 GDPR.
To exercise your rights, you can contact info@exitroom.de.
You can withdraw consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
You can change or withdraw consent to cookies, statistics, marketing and external media directly through “Cookie Settings”.


30. Right to Object

Where we process personal data on the basis of Article 6(1)(e) or (f) GDPR, you have the right pursuant to Article 21 GDPR to object to the processing at any time on grounds relating to your particular situation.
Following an objection, we will no longer process the data concerned unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.
Where personal data is processed for direct marketing purposes, you may object to this processing at any time without giving specific reasons. Following your objection, the data will no longer be processed for direct marketing purposes.


31. Right to Lodge a Complaint

Pursuant to Article 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes the GDPR.
In particular, you may contact the State Commissioner for Data Protection and the Right of Access to Files of Brandenburg, which is the supervisory authority responsible for us, or any other competent data protection supervisory authority.
3

2. Updates to This Privacy Policy

We amend this Privacy Policy whenever the services used, the data processing activities or the legal requirements change.
Last updated: 9 August 2026