We are delighted by your interest in our company. Data protection is a particularly high priority for the management of Gut Hügle GmbH. As a rule, you can use the Gut Hügle GmbH websites without providing any personal data. However, if someone wishes to use special services offered by our company through the website, processing personal data may become necessary. If processing is necessary and no legal basis exists for it, we generally obtain the person’s consent.

Personal data, such as a person’s name, address, email address or telephone number, is always processed in accordance with the General Data Protection Regulation and the national data-protection provisions applicable to Gut Hügle GmbH. Through this privacy policy, our company informs the public about the nature, scope and purpose of the personal data we collect, use and process. It also explains the rights of persons concerned.

As controller, Gut Hügle GmbH has implemented numerous technical and organisational measures to provide the most complete possible protection for personal data processed through this website. Nevertheless, data transmission over the internet can have security vulnerabilities, so absolute protection cannot be guaranteed. For this reason, anyone may send personal data to us by alternative means, for example by telephone.

The privacy policy of Gut Hügle GmbH uses the terminology adopted by the European legislator when issuing the General Data Protection Regulation (GDPR). Our policy is intended to be easy to read and understand for the public as well as our customers and business partners. To ensure this, we first explain the terms used.

Among other things, this privacy policy uses the following terms:

• a) Personal data Personal data means any information relating to an identified or identifiable natural person (hereinafter “person concerned”). A natural person is identifiable if they can be identified directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data or online identifier, or to one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.
• b) Person concerned A person concerned is any identified or identifiable natural person whose personal data is processed by the controller.
• c) Processing Processing means any operation or set of operations performed on personal data, with or without automated means. This includes collecting, recording, organising, structuring, storing, adapting or altering, retrieving, consulting, using, disclosing by transmission, disseminating or otherwise making available, aligning or combining, restricting, erasing or destroying data.
• d) Restriction of processing Restriction of processing means marking stored personal data with the aim of limiting its future processing.
• e) Profiling Profiling means any form of automated processing of personal data used to evaluate personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that person’s job performance, financial situation, health, personal preferences, interests, reliability, behaviour, location or movements.
• f) Pseudonymisation Pseudonymisation means processing personal data so that it can no longer be attributed to a specific person without additional information, provided that the additional information is kept separately and is subject to technical and organisational measures ensuring that the personal data cannot be attributed to an identified or identifiable natural person.
• g) Controller or controller responsible for processing The controller, or controller responsible for processing, is the natural or legal person, public authority, agency or other body that alone or jointly with others determines the purposes and means of processing personal data. Where Union or Member State law determines the purposes and means of processing, that law may also specify the controller or the criteria for its designation.
• h) Processor A processor is a natural or legal person, public authority, agency or other body that processes personal data on behalf of the controller.
• i) Recipient A recipient is a natural or legal person, public authority, agency or other body to whom personal data is disclosed, whether or not they are a third party. However, public authorities that may receive personal data as part of a specific inquiry under Union or Member State law are not considered recipients.
• j) Third party A third party is a natural or legal person, public authority, agency or other body other than the person concerned, the controller, the processor, or persons authorised to process personal data under the direct authority of the controller or processor.
• k) Consent Consent means any freely given, specific, informed and unambiguous indication of a person’s wishes, given by a statement or by a clear affirmative action, by which they signify agreement to the processing of personal data relating to them.

The controller within the meaning of the General Data Protection Regulation, other data-protection laws applicable in the Member States of the European Union and other provisions of a data-protection nature is:

Gut Hügle GmbH

Bottenreute 5-7

88214 Ravensburg

Germany

Tel.: 0751 1895000

Email: Contact

Website: guthuegle.de

On your first visit, we ask whether we may use cookies and similar technologies for statistics and advertising. Technically necessary storage (for example your language setting and cookie choice) takes place without consent under section 25(2), no. 2 TDDDG. We store your choice using CookieHub (CookieHub ehf., Iceland). Your decision, a random identifier and the time are stored so that we can demonstrate consent (Article 6(1)(c) in conjunction with Article 7(1) GDPR). You can change or withdraw your choice at any time via “Cookie settings” at the bottom of the page. Our cookie policy lists the individual cookies we use.

Our website is delivered via Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, USA). Cloudflare processes your IP address, browser details and the page accessed to deliver the website quickly and securely and prevent attacks (Article 6(1)(f) GDPR). Cloudflare acts as our processor and is certified under the EU-US Data Privacy Framework; the EU Standard Contractual Clauses also apply. We store content and form data in databases located in the EU. Our content management system and website software are operated on our behalf by Beinhauer Consulting (Denis Beinhauer, Löwenstr. 1, 88353 Kißlegg).

Whenever a person or automated system visits the Gut Hügle GmbH website, it collects a range of general data and information. This is stored in the server log files. The information collected may include (1) the browser types and versions used, (2) the operating system used by the accessing system, (3) the website from which the accessing system reached our website (the so-called referrer), (4) the subpages visited on our website, (5) the date and time of access, (6) an Internet Protocol address (IP address), (7) the internet service provider of the accessing system and (8) other similar data and information used to prevent threats in the event of attacks on our information technology systems.

Gut Hügle GmbH does not use this general data and information to draw conclusions about the person concerned. Instead, it is needed to (1) deliver our website content correctly, (2) optimise our website content and its advertising, (3) ensure the continued operation of our information technology systems and website technology, and (4) provide law-enforcement authorities with the information they need to investigate a cyberattack. Gut Hügle GmbH therefore analyses this anonymously collected data and information statistically and also uses it to strengthen data protection and security within our company, ultimately ensuring the best possible protection for the personal data we process. Anonymous server log-file data is stored separately from all personal data provided by a person concerned.

We use Mailchimp (The Rocket Science Group LLC, 405 N. Angier Ave. NE, Atlanta, GA 30308, USA) as a processor for our newsletter. After signing up, you receive a confirmation email; your subscription only becomes active when you click the link in it. We store your email address, the times and IP addresses of signup and confirmation, and whether you open newsletters and which links you click. The legal basis is your consent (Article 6(1)(a) GDPR). You can unsubscribe using the link in every newsletter. Mailchimp is certified under the EU-US Data Privacy Framework; the EU Standard Contractual Clauses also apply.

As required by law, the Gut Hügle GmbH website provides information that enables quick electronic contact with our company and direct communication with us, including a general electronic mail address (email address). If a person contacts the controller by email or through a contact form, the personal data they provide is stored automatically. Personal data voluntarily sent to the controller is stored to process the request or contact that person. To handle enquiries, we use processors: Google Workspace for our mailboxes and D3X for the first response via chat, phone and WhatsApp (see the AI assistant section).

The controller processes and stores a person’s personal data only for as long as needed to achieve the purpose for which it was collected, or as required by the European legislator or another legislator in laws or regulations that apply to the controller.

Once the storage purpose no longer applies or a retention period prescribed by the European legislator or another competent legislator expires, personal data is routinely blocked or erased in accordance with legal requirements.

• a) Right to confirmation Every person has the right, granted by the European legislator, to ask the controller to confirm whether personal data concerning them is being processed. Anyone wishing to exercise this right may contact an employee of the controller at any time.
• b) Right of access Anyone whose personal data is processed has the right, granted by the European legislator, to obtain free access from the controller at any time to the personal data stored about them, along with a copy. The European legislator has also granted the person the right to receive information about the following:
• the purposes of processing
• the categories of personal data being processed
• the recipients, or categories of recipients, to whom the personal data has been or will be disclosed, particularly recipients in third countries or international organisations
• where possible, the planned period for which the personal data will be stored or, if this is not possible, the criteria used to determine that period
• the existence of a right to request rectification or erasure of personal data concerning them, restriction of processing by the controller, or to object to that processing
• the existence of a right to lodge a complaint with a supervisory authority
• if the personal data was not collected from the person concerned: all available information about its source
• the existence of automated decision-making, including profiling, under Article 22(1) and (4) of the GDPR and, at least in those cases, meaningful information about the logic involved and the significance and intended effects of such processing for the person concerned
• The person also has the right to know whether personal data has been transferred to a third country or an international organisation. If it has, the person has the right to be informed of the appropriate safeguards relating to the transfer. Anyone wishing to exercise this right of access may contact an employee of the controller at any time.
• c) Right to rectification Anyone whose personal data is processed has the right, granted by the European legislator, to request the immediate rectification of inaccurate personal data concerning them. The person also has the right to request completion of incomplete personal data, including by means of a supplementary statement, taking into account the purposes of processing. Anyone wishing to exercise this right to rectification may contact an employee of the controller at any time.
• d) Right to erasure (right to be forgotten) Anyone whose personal data is processed has the right, granted by the European legislator, to ask the controller to erase personal data concerning them without delay if one of the following grounds applies and processing is not necessary:
• The personal data was collected or otherwise processed for purposes for which it is no longer needed.
• The person withdraws consent on which processing was based under Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR, and there is no other legal basis for processing.
• The person objects to processing under Art. 21(1) GDPR and there are no overriding legitimate grounds for processing, or the person objects to processing under Art. 21(2) GDPR.
• The personal data was processed unlawfully.
• The personal data must be erased to comply with a legal obligation under Union law or the law of a Member State to which the controller is subject.
• The personal data was collected in relation to information society services offered under Art. 8(1) GDPR.
• If one of the grounds listed above applies and a person wishes to have personal data stored by Gut Hügle GmbH erased, they may contact an employee of the controller at any time. That employee will ensure the request is carried out without delay. If Gut Hügle GmbH has made personal data public and is required to erase it as controller under Art. 17(1) GDPR, it will, taking account of available technology and implementation costs, take reasonable measures, including technical measures, to inform other controllers processing the published data that the person has requested erasure of all links to, copies of or reproductions of that data, insofar as processing is not necessary. An employee of Gut Hügle GmbH will take the necessary steps in each case.
• e) Right to restriction of processing Anyone whose personal data is processed has the right, granted by the European legislator, to ask the controller to restrict processing if one of the following conditions is met:
• The person contests the accuracy of the personal data, for a period that allows the controller to verify its accuracy.
• Processing is unlawful, and the person objects to erasure of the personal data and instead requests restriction of its use.
• The controller no longer needs the personal data for processing, but the person needs it to establish, exercise or defend legal claims.
• The person has objected to processing under Art. 21(1) GDPR, and it has not yet been determined whether the controller’s legitimate grounds override those of the person.
• If one of the conditions above is met and a person wishes to restrict personal data stored by Gut Hügle GmbH, they may contact an employee of the controller at any time. The employee will arrange for processing to be restricted.
• f) Right to data portability Anyone whose personal data is processed has the right, granted by the European legislator, to receive the personal data concerning them that they have provided to a controller in a structured, commonly used and machine-readable format. They also have the right to transmit those data to another controller without hindrance from the controller to whom they provided them, if processing is based on consent under Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR, or on a contract under Art. 6(1)(b) GDPR, and is carried out by automated means, unless processing is necessary for a task in the public interest or in the exercise of official authority vested in the controller. When exercising the right to data portability under Art. 20(1) GDPR, the person also has the right, where technically feasible, to have the personal data transmitted directly from one controller to another, provided this does not adversely affect the rights and freedoms of others. To exercise this right, the person may contact an employee of Gut Hügle GmbH at any time.
• g) Right to object Anyone whose personal data is processed has the right, granted by the European legislator, to object at any time, on grounds relating to their particular situation, to processing of personal data concerning them under Art. 6(1)(e) or (f) GDPR. This also applies to profiling based on those provisions. If an objection is made, Gut Hügle GmbH will no longer process the personal data unless we can demonstrate compelling legitimate grounds for processing that override the person’s interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. If Gut Hügle GmbH processes personal data for direct marketing, the person has the right to object at any time to processing for that advertising. This also applies to profiling related to such direct marketing. If the person objects to processing for direct marketing, Gut Hügle GmbH will no longer process the personal data for those purposes. The person also has the right, on grounds relating to their particular situation, to object to processing by Gut Hügle GmbH of personal data concerning them for scientific or historical research or statistical purposes under Art. 89(1) GDPR, unless the processing is necessary to perform a task in the public interest. To exercise the right to object, the person may contact any employee of Gut Hügle GmbH directly. In connection with information society services, and notwithstanding Directive 2002/58/EC, the person may also exercise this right through automated procedures using technical specifications.
• h) Automated individual decision-making, including profiling Anyone whose personal data is processed has the right, granted by the European legislator, not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, unless the decision (1) is necessary for entering into or performing a contract between the person and the controller, or (2) is authorised by Union or Member State law to which the controller is subject and that law provides appropriate measures to safeguard the person’s rights, freedoms and legitimate interests, or (3) is based on the person’s explicit consent. If the decision (1) is necessary for entering into or performing a contract between the person and the controller or (2) is based on the person’s explicit consent, Gut Hügle GmbH will take appropriate measures to safeguard the person’s rights, freedoms and legitimate interests. These include at least the right to obtain human intervention from the controller, to present their point of view and to contest the decision. Anyone wishing to exercise rights relating to automated decisions may contact an employee of the controller at any time.
• i) Right to withdraw data-protection consent Anyone whose personal data is processed has the right, granted by the European legislator, to withdraw consent to the processing of personal data at any time. Anyone wishing to exercise this right may contact an employee of the controller at any time.

You may lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, www.baden-wuerttemberg.datenschutz.de.

• Data protection supervisory authority Baden-Württemberg

The controller collects and processes applicants’ personal data to manage the recruitment process. Processing may also take place electronically, particularly when an applicant sends application documents to the controller by email or through a web form on the website. If the controller enters into an employment contract with an applicant, the submitted data is stored to manage the employment relationship in accordance with legal requirements. If no employment contract is concluded, the application documents are automatically erased two months after the rejection decision is communicated, unless other legitimate interests of the controller prevent erasure. One such interest may be the need to provide evidence in proceedings under the General Equal Treatment Act (AGG).

Only if you agree in the cookie banner do we load Google Tag Manager, Google Analytics 4 and Google Ads conversion tracking (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). We use these to measure how our pages are used and whether our advertisements lead to bookings. Google receives device and usage data and an online identifier; Google Analytics does not store full IP addresses. The legal basis is your consent (Article 6(1)(a) GDPR, section 25(1) TDDDG). Google may transfer data to the USA; Google LLC is certified under the EU-US Data Privacy Framework. We delete analytics data after 14 months at the latest. These services are not loaded without your consent.

Art. 6 I lit. a GDPR is the legal basis for processing operations for which we obtain consent for a specific purpose. If processing personal data is necessary to perform a contract to which the person concerned is a party, for example to deliver goods or provide another service or consideration, processing is based on Art. 6 I lit. b GDPR. The same applies to processing necessary to take pre-contractual steps, such as responding to enquiries about our products or services. If our company is subject to a legal obligation that requires processing personal data, for example to meet tax obligations, processing is based on Art. 6 I lit. c GDPR. In rare cases, processing personal data may be necessary to protect the vital interests of the person concerned or another natural person. This may be the case if a visitor is injured at our business and their name, age, health-insurance details or other vital information must be shared with a doctor, hospital or another third party. Processing would then be based on Art. 6 I lit. d GDPR. Finally, processing may be based on Art. 6 I lit. f GDPR. This legal basis covers processing not covered by any of the grounds above when it is necessary to protect a legitimate interest of our company or a third party, provided the interests, fundamental rights and freedoms of the person concerned do not override it. The European legislator has specifically recognised that such processing may be permitted, noting that a legitimate interest may exist where the person concerned is a customer of the controller (Recital 47, sentence 2 GDPR).

Where we base data processing on Article 6(1)(f) GDPR, our legitimate interests are: secure and stable operation of our website and systems, protection against misuse and payment fraud, answering general enquiries, establishing and defending claims, and audience measurement and advertising, which we carry out only with your consent.

The applicable statutory retention period determines how long personal data is stored. Once that period expires, the corresponding data is routinely erased unless it is still needed to perform or prepare a contract.

We inform you that providing personal data may be required by law (for example, tax rules) or under contractual terms (for example, details about the contracting party). In some cases, it may be necessary for a person to provide us with personal data that we must then process in order to conclude a contract. For example, a person must provide personal data if our company enters into a contract with them. If the data is not provided, the contract cannot be concluded. Before providing personal data, the person should contact one of our employees. Our employee will explain for each case whether providing the data is required by law or contract, or necessary to conclude the contract, whether there is an obligation to provide it and the possible consequences of not doing so.

As a responsible company, we do not use automated decision-making or profiling.