Source: https://castrum-nigra.de/en/dataprotection
Timestamp: 2019-04-20 09:20:10+00:00

Document:
The following gives a simple overview of what happens to personal information, which rights guests have and how to use these rights.
Data transmission via the internet (e.g. via e-mail communication) may be subject to security breaches. Complete protection of your data from third-party access is not possible.
This site uses SSL or TLS encryption for security reasons and for the protection of the transmission of confidential content, such as the inquiries guests send to the operator. An encrypted connection changes the address line of the browser from "http://" to "https://" and shows a lock-icon in the browser's address bar.
In accordance with Art. 15 GDPR, guests may request a confirmation as if personal data of them is actually in process. If this is the case, guests have the right to get information about the processed information.
Insofar as the processing of personal data takes place on the basis of a consent, according to Art. 7 GDPR the right exists to revoke this consent at any time.
If the processing of personal data is necessary to the legitimate interests of the operator, the guests concerned may object to the processing at any time in accordance with Art. 21 GDPR.
Unless guests have revoked their consent, have objected to the processing of their personal data (and there are no legitimate grounds for processing), personal data is no longer necessary for the purposes of processing, there is a corresponding legal obligation or unlawful processing of personal data affected guests have the right to demand the deletion of their personal data in accordance with Art. 17 GDPR.
If personal data has been processed incorrectly, the affected guests have the right, under Art. 16 GDPR, to demand the correction of this data immediately.
Under the conditions of Article 18 GDPR all guests have the right to demand the restriction of the processing of their personal data.
All guests have the right, in accordance with Art. 20 GDPR, to receive personal data provided by them in a structured, common and machine-readable format.
To assert these rights, an informal e-mail to the operator is sufficient.
If there has been a breach of data protection legislation, the person affected may file a complaint with the competent regulatory authorities. The competent regulatory authority for matters related to data-protection-legislation is the data-protection-officer of the German state in which our company is headquartered. A list of data-protection-officers and their contact-details can be found at the following link: https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html.
The website of the operator uses "cookies". Cookies do not harm computers and do not contain any viruses. Cookies help make the website more user-friendly, efficient, and secure. Cookies are small text files that are stored on your computer and saved by your browser.
Most of the used cookies are so-called "session cookies." They are automatically deleted after the visit of the website. Other cookies remain in guests device's memory until they are delete by the guests. These cookies make it possible to recognize a browser when it visits the website again.
Cookies which are necessary to allow electronic communications or to provide certain functions guests wish to use (such as the shopping cart) are stored pursuant to Art. 6 paragraph 1, letter f of GDPR. The website operator has a legitimate interest in the storage of cookies to ensure an optimized service provided free of technical errors.
The operators website-provider automatically collects and stores information that a browser automatically transmits in so called "server-log-files".
These data will not be combined with data from other sources and the identification of the guests on the basis of this data will not take place unless required by law.
The operator collects, processes, and uses personal data only insofar as it is necessary to establish, or modify legal relationships with us (master data). This is done based on Art. 6 (1) (b) GDPR, which allows the processing of data to fulfill a contract or for measures preliminary to a contract.
Personal data when accessing the website (usage data) is processed and used by the operator only to enable guests to access the service or to bill for the same.
The operator transmits personally identifiable data to third parties only to fulfill the terms of contracts, for example, to companies entrusted to deliver goods to your location or banks entrusted to process your payments. This data will not be transmitted for any other purpose unless the affected guest has given an express permission to do so. The data will not be disclosed to third parties for advertising purposes without an express consent.
The operator collects and processes data in the context of administrative tasks as well as the organization of operations, financial-accounting and compliance with legal obligations, such as: archiving.
The processing principles are Art. 6 para. 1 lit. c. GDPR, Art. 6 para. 1 lit. f. GDPR. The purpose and interest in processing are the administration, financial-accounting, office-organization, data-archiving, tasks that serve the maintenance of business-activities, the performance of operational-tasks and the provision of operational-services.
The operator hereby discloses or transmits data to the tax authorities, to consultants, such as tax-accountants or auditors, as well as to other fee-offices and payment-service-providers.
Furthermore, based on the business interests, the operator stores information about suppliers, organizers and other business partners, e.g. for later contact.
This in majority company-related data is always stored permanently.
The operator's website uses plugins from the YouTube website operated by YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA.
YouTube integration is in enhanced privacy mode. This mode, according to YouTube, means that YouTube does not store any information about the visitors to this site before they watch the video. However, sharing data with YouTube partners is not necessarily excluded by the enhanced privacy mode. For example, regardless of whether a video is viewed, YouTube connects to the Google DoubleClick network.
Once guests launch a YouTube video on the operator's website, they will be connected to the servers of YouTube. This tells the YouTube server which web page was accessed. If you are logged into your own YouTube account at this time, YouTube allows you to assign surfing behavior directly to the personal profile. This can be prevented by logging out of the YouTube account.
Furthermore, after starting a video, YouTube can store various cookies on the guest's device. With the help of these cookies, YouTube can receive information about visitors to the website of the operator. This information will u. a. used to capture video statistics, improve usability, and prevent fraud. The cookies remain on the guest's device until they are deleted.
If necessary, additional data processing operations can be triggered after the start of a YouTube video that the operator of this website has no control over.
The use of YouTube is in the interest of an attractive presentation of this website. This constitutes a legitimate interest within the meaning of Art. 6 (1) (f) GDPR.
For uniform representation of fonts, this page uses "Google-Web-Fonts". When you open a page, your browser loads the required web-fonts into your browser cache to display texts and fonts correctly. For this purpose your browser has to establish a direct connection to Google servers. Google thus becomes aware that our web page was accessed via your IP address.
The use of Google-Web-Fonts is done in the interest of a uniform and attractive presentation of the website. This constitutes a justified interest pursuant to Art. 6 (1) (f) GDPR.
The use of Google Web fonts makes it easier for guests to use this website and optimizes the presentation of the website. Google is Privacy Shield Certified (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI), which guarantees compliance with the GDPR and all other data protection laws or regulations in the EU Member States. Additional information about computing can be found at https://developers.google.com/fonts/faq and https://www.google.com/policies/.

References: Art. 15
 Art. 7
 Art. 21
 Art. 17
 Art. 16
 Art. 20
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6