We are pleased that you are visiting our website www.visit-rothenburg.com and that you are interested in our activities and offerings. Despite careful review of their content, we accept no liability for external links to third-party content, because we neither initiated the transmission of that information nor selected or modified the recipient or the transmitted information itself. We also cannot guarantee that the links shown (for example those in this privacy policy) are up to date and therefore functional.

Protecting your personal data when it is collected, processed and used in connection with your visit to our websites is important to us and is carried out within the framework of the statutory provisions, about which you can find information at https://www.bfdi.bund.de, for example.

1. Validity and amendment of this privacy policy

The privacy policy set out below is the version currently in force.

As our website and the offerings available through it are developed further, or as a result of changes to statutory or regulatory requirements, it may become necessary to amend this privacy policy.

2. Data security

We endeavour to take all necessary technical and organisational security measures to store your personal data in such a way that it is accessible neither to third parties nor to the public. If you wish to contact us by e-mail, please note that the confidentiality of the information transmitted cannot be fully guaranteed by this channel. We therefore recommend that you send confidential information to us by post only.

For security reasons, and to protect the transmission of confidential content (e.g. orders or enquiries) that you send to us as the site operator, this site uses SSL or TLS encryption. When SSL or TLS encryption is active, the data you transmit to us cannot be read by third parties. You can recognise an encrypted connection of this kind by the address bar of your browser changing from “http://” to “https://” and by the padlock symbol being displayed.

3. Contact details of the controller

Rothenburg Tourismus Service

Marktplatz 2
91541 Rothenburg ob der Tauber
Germany

Phone: +49 9861 404-800
Fax: +49 9861 404-529
E-mail: info@rothenburg.de

4. Data protection officer

Data protection officer for municipalities within the district
Landratsamt Ansbach
Sachgebiet 25
Crailsheimstraße 1
91522 Ansbach
Germany
Phone: +49 981 468-2500
Fax: +49 981 468-18 2519
E-mail: dsb-gemeinden@landratsamt-ansbach.de

Record of processing activities and information pursuant to Art. 13 GDPR

Below we explain what information we collect during your visit to our websites and how it is used.

5. Collection and storage of personal data, and the nature and purpose of its use

a) When you visit the website

If you use our website purely for information purposes, i.e. if you do not register or otherwise transmit information to us, the internet browser used on your device (computer, laptop, tablet, smartphone, etc.) automatically sends information to the server hosting our website. This information is stored temporarily in what is known as a log file.

The following data is recorded without any action on your part and stored until it is automatically deleted:

• IP address
• Date and time of the request
• Time zone difference from Greenwich Mean Time (GMT)
• Content of the request (the specific page)
• Access status / HTTP status code
• Volume of data transferred in each case
• Website from which the request originates
• Browser
• Operating system and its interface
• Language and version of the browser software
• Location data, including location data from your mobile device. Please note that on most mobile devices you can control or disable the use of location services in the device settings menu.

We store this data for reasons of technical security, in particular to defend against attempted attacks on our web server. After seven days at the latest, the data is anonymised by truncating the IP address to domain level, so that it is no longer possible to establish a link to individual users. This data is collected in accordance with Art. 6(1)(1)(e) GDPR.

The data referred to above is processed for the aforementioned purposes by our web host (Mittwald CM Service GmbH & Co. KG, Königsberger Straße 4-6, 32339 Espelkamp, on behalf of inixmedia GmbH, Liesenhörnweg 13, 24222 Schwentinental). Under no circumstances do we use the data collected for the purpose of drawing conclusions about you personally.

b) When you use our contact form

If you contact us by e-mail, by telephone or via our contact form, the data you provide (your e-mail address, your name and, where applicable, your telephone number) is stored by us in order to respond to your enquiry. We delete the data arising in this context once it is no longer necessary to store it, e.g. once your enquiry has been dealt with. Otherwise, processing is restricted if statutory retention obligations apply.

The legal basis for this is your consent pursuant to Art. 6(1)(1)(a) GDPR.

c) Damage reporting form

Our website provides a form that can be used to report damage in public spaces. If you make use of this option, the data entered in the input screen is transmitted to us and stored. This data comprises: category, image, description of the damage, location of the damage, first name and surname, e-mail address. We process the personal data from the input screen solely in order to deal with the damage report. The legal basis for processing your personal data is consent pursuant to Art. 6(1)(a) GDPR.

Your personal data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. This is the case when the circumstances indicate that the matter concerned has been conclusively resolved. The additional personal data collected during the submission process is deleted after seven days at the latest.

d) Registration on our website

You can register on our website in order to use the additional functions it offers. These functions are the promotion of events, the reporting of address data, and access to intranet pages for and within our region. For this purpose, events and associated information can be published on our website following registration.

For registration we ask you to provide the following personal data:

Data that identifies you personally, such as your name and e-mail address, postal address and telephone number, as well as further personal data that we are legally obliged or entitled to collect and process and that we require for your authentication or identification, or in order to verify the data we have collected.

We use the data entered solely for the purpose of the function for which you have registered. The mandatory information requested during registration must be provided in full and truthfully. Otherwise we will refuse the registration.

We use the e-mail address provided during registration to inform you of significant changes, for example to the scope of the service or in the case of technically necessary changes.

The data entered during registration is processed on the basis of your consent (Art. 6(1)(1)(a) GDPR). You may withdraw consent you have given at any time. An informal message to us by e-mail is sufficient for this purpose. The lawfulness of the data processing already carried out remains unaffected by the withdrawal.

We store the data collected during registration for as long as you are registered on our website, after which it is deleted. Statutory retention periods remain unaffected.

6. Rights of data subjects

On request, we will be happy to inform you whether and which personal data relating to you is stored (Art. 15 GDPR), in particular about the purposes of the processing, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the envisaged storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the origin of your data where it was not collected by us, and the existence of automated decision-making, including profiling.

You also have the right to have any inaccurately collected personal data rectified, or incompletely collected data completed (Art. 16 GDPR).

You further have the right to request that we restrict the processing of your data, provided the statutory requirements for this are met (Art. 18 GDPR).

You have the right to receive the personal data concerning you in a structured, commonly used and machine-readable format, or to request that it be transmitted to another controller (Art. 20 GDPR).

In addition, you have what is known as the “right to be forgotten”, i.e. you may request that we erase your personal data, provided the statutory requirements for this are met (Art. 17 GDPR).

Irrespective of this, your personal data is deleted by us automatically if the purpose for which it was collected no longer applies or if the processing was unlawful.

Where the processing of personal data is based on consent that has been given, you have the right to withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out on the basis of the consent up to the point of withdrawal.

You also have the right to object at any time to the processing of your personal data, provided a right to object is provided for by law. In the event of an effective withdrawal, your personal data is likewise deleted by us automatically (Art. 21 GDPR).

To exercise rights relating to data protection, or if you have questions about the use, collection or processing of your personal data, please contact: datenschutz@rothenburg.de

Without prejudice to any other administrative or judicial remedy, you also have the right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement, if you consider that the processing of personal data relating to you infringes that Regulation. You can find the relevant addresses at https://www.bfdi.bund.de.

Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR, you have the right to an effective judicial remedy if you consider that your rights under this Regulation have been infringed as a result of processing of your personal data that does not comply with the Regulation.

7. German Telecommunications and Digital Services Data Protection Act (TDDDG)

The legal basis for storing information in, and accessing information on, the end user's terminal equipment is consent pursuant to Section 25(1)(1) TDDDG. This consent is requested when the website is accessed. Pursuant to Section 25(2)(2) TDDDG, consent is not required where the storage of information in the end user's terminal equipment, or access to information already stored in that equipment, is strictly necessary in order for the provider of a telemedia service to provide a telemedia service expressly requested by the user. The cookie settings show which cookies are classified as strictly necessary (often also referred to as “technically necessary cookies”) and therefore fall under the exemption in Section 25(2) TDDDG and do not require consent. Please note that the legal basis for the subsequent processing of personal data then follows from the GDPR. The relevant legal bases for the processing of personal data on this website are set out in the remainder of this privacy policy.

8. Disclosure of personal data

This notice applies to all services connected by way of processing on our behalf, and to all options for integrating optional modules. Where separate consent is required, it will be obtained.

Your data is not transferred to third parties for purposes other than those listed below.

We only pass your data on to third parties if:

you have given express consent to this (Art. 6(1)(1)(a) GDPR), or this is necessary for handling enquiries or administrative acts, or for the performance of contracts with you (Art. 6(1)(b) or Art. 6(1)(1)(e) GDPR); this also includes enquiries made via this website and the associated disclosure of personal data to processors.

In these cases, however, the scope of the data transmitted is limited to the necessary minimum.

Our data protection provisions are in line with the applicable data protection legislation, and the data is processed only in the Federal Republic of Germany / the European Union. No transfer to third countries takes place, and none is intended.

9. Cookies

In addition to the data referred to above, cookies or similar technologies such as pixels (hereinafter referred to generally as “cookies”) are used on your computer when you use and visit our website. Cookies are either small databases that your browser stores on your device in order to retain certain information, or image files such as pixels. The next time you access our website using the same device, the information stored in cookies is sent back either to our website (“first-party cookie”) or to another website to which the cookie belongs (“third-party cookie”).

The information stored and sent back allows the website in question to recognise that you have already accessed and visited it using the browser on your device. We use this information in order to design and display the website in the way that best suits your preferences. In doing so, only the cookie itself is identified on your device. Personal data is only stored beyond this with your express consent, or where this is strictly necessary in order to use the service you have requested and accessed.

This website may use the following types of cookie, whose scope and functioning are explained below:

• Strictly necessary cookies (type a)
• Functional and performance cookies (type b)
• Consent-based cookies (type c)

Strictly necessary cookies (type a)

Strictly necessary cookies ensure functions without which you would not be able to use our websites as intended. These cookies are used exclusively by us and are therefore first-party cookies. This means that all information stored in the cookies is returned to our website.

Strictly necessary cookies serve, for example, to keep you logged in as a registered user when you access different sub-pages of our website, so that you do not have to re-enter your login details each time you open a new page.

Strictly necessary cookies may be used on our website without your consent. For this reason, strictly necessary cookies cannot be individually enabled or disabled. However, you can disable cookies in your browser generally at any time (see below).

Functional and performance cookies (type b)

Functional cookies enable our website to store information you have already provided (such as a registered name or language selection) and, on that basis, to offer you improved and more personalised functions. These cookies collect and store anonymised information only, so that they cannot track your movements on other websites.

Performance cookies collect information about how our websites are used, so that their appeal, content and functionality can be improved. These cookies help us, for example, to determine whether and which sub-pages of our website are visited and which content is of particular interest to users. Specifically, we record in particular the number of visits to a page, the number of sub-pages accessed, the time spent on our website, the order of the pages visited, which search terms brought you to us, the country, the region and, where applicable, the city from which access takes place, and the proportion of mobile devices accessing our websites. We also record movements, clicks and scrolling with the computer mouse in order to understand which areas of our website are of particular interest to users. This allows us to tailor the content of our website more closely to our users' needs and to optimise what we offer. The IP address of your computer, which is transmitted for technical reasons, is anonymised automatically and does not allow us to draw any conclusions about the individual user.

You can object to the use of functional and performance cookies at any time by adjusting your cookie settings accordingly.

Legal basis: Art. 6(1)(e) GDPR

Consent-based cookies (type c)

Cookies that are neither strictly necessary (type a) nor functional or performance cookies (type b) are only used after you have given your consent.

Marketing cookies originate from external advertising companies (third-party cookies) and are used to collect information about the websites visited by the user in order to create targeted advertising for that user.

Legal basis: Art. 6(1)(a) GDPR

Managing and deleting all cookies

You can also configure your internet browser so that the storage of cookies on your device is prevented altogether, or so that you are asked each time whether you consent to cookies being set. You can also delete cookies that have been set at any time. You will find details of how all of this works in your browser's help function.