Information

From the South take the A9 in the direction of Ingol­stadt/­Nürn­berg/­Berlin; from the North take the A9 in the direction of Munich. Exit the A9 at junction Allers­hausen (67) and follow the signs to the left in the direction of Hohen­kam­mer. Leave the round­about at the second exit and follow the road, via Egl­hausen, to Hohen­kam­mer. At the end of the road, at Hohen­kam­mer, turn right onto the B13 in the direction of Ingol­stadt. Follow the main road past the church and then turn left onto Peters­hau­ser Straße. You will reach Schloss­straße on the right after 100 metres. Parking spaces are located directly after the bridge on your left.

Leave the airport and get onto the A92 in the direction of Eching/­Munich. Change over to the A9 in the direction of Ingol­stadt/­Nürn­berg/­Berlin at the motor­way inter­section Neu­fahrn. Exit the A9 at junction Allers­hausen (67) and follow the above directions.

The taxi ride from Munich’s Central Station to Hohen­kam­mer costs approx­i­mately 120 euros. Visitors should calculate 95 euros for a trip from the airport.

Take the suburban rail, S2, from Munich’s Central Station in the direction of Ingol­stadt and get off at Peters­hausen. Schloss Hohen­kam­mer is just a few kilometres from Petershausen and easy to reach by taxi.

Schloss Hohenkammer GmbH (SH) is pleased that you are visiting our website and about your interest in our company. We take the protection and security of your personal information seriously and want you to feel safe and comfortable while visiting our website and using our services.

The following notes provide a simple overview of what happens to your personal data when you visit this website. Personal data is all data which could be used to identify you personally. For detailed information on data protection, please refer to our privacy statement below.

Who is responsible for the data collection on this website?

Data processing on this website is carried out by the website operator. You can find their contact details in the section "Information regarding the controller" in this privacy statement.

How do we collect your data?

Your data is collected, firstly, when you provide it to us. For example, this could be data that you enter into a contact form.

Other data is collected by our IT systems automatically or with your consent when you visit the website. These are primarily technical details (e.g. web browser, operating system or the time the page was accessed). This data is collected automatically as soon as you access this website.

What do we use your data for?

Some of the data is collected to ensure the website functions correctly. We process further data, in particular, to process enquiries and bookings and to provide the services you use.

What are your rights with respect to your data?

You have the right to receive information on the origin, recipients and purpose of the personal data saved about you without charge at any time. You also have the right to demand the correction or deletion of this data. If you have given your consent to data processing, you can revoke this consent at any time for the future. In addition, you have the right to request the restriction of the processing of your personal data in certain circumstances. Furthermore, you have the right to lodge a complaint with the relevant supervisory authority.

Please feel free to contact us at any time regarding this matter or any other questions you may have about data protection.

Below we describe the processing of personal data when using our website. Personal data is all data that relates to you personally.

Data protection

The operators of these pages take the protection of your personal data very seriously. We treat your personal data in confidence and in accordance with statutory data protection regulations, as well as this privacy statement.

When you use this website, various personal data will be collected. Personal data is data which could be used to identify you personally. This privacy statement explains which data it is we collect and what we use it for. It also explains how and for what purpose this occurs.

Please note that the transmission of data over the Internet – during email communication, for example – may have security flaws. The protection of data from third-party access can never be guaranteed.

Information regarding the controller

The controller for the processing of data on this website is:
Schloss Hohenkammer GmbH
Schlossstraße 18–25
85411 Hohenkammer
Germany
Phone +49 (0)8137 93 40
E-mail

The controller is the natural or juristic person who decides on the purpose and means of processing personal data (e.g. names, email addresses, etc.) either alone or together with others.

Retention period

Unless a more specific retention period is stated in this privacy statement, we will retain your personal data until the purpose for which it is processed no longer applies. If you submit a valid request for erasure or withdraw your consent to data processing, your data will be erased unless we have other legally permissible grounds for storing your personal data (e.g. retention periods under tax or commercial law); in the latter case, the data will be erased once these grounds no longer apply.

General information on the legal basis of data processing on this website

If you have given your consent to data processing, we process your personal data on the basis of Article 6(1)(a) of the GDPR or Article 9(2)(a) of the GDPR if special categories of data within the meaning of Article 9(1) of the GDPR are processed. In the event of explicit consent to the transfer of personal data to third countries, data processing is also carried out on the basis of Article 49(1)(a) of the GDPR. If you have consented to the storage of cookies or to access to information on your device (e.g. via device fingerprinting), the processing of data is additionally based on § 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG). Consent is revocable at any time. If your data is required for the performance of a contract or to take steps prior to entering into a contract, we process your data on the basis of Article 6(1)(b) of the GDPR. Furthermore, if your data is required for compliance with a legal obligation, we process it on the basis of Article 6(1)(c) of the GDPR. Data processing may also be carried out on the basis of our legitimate interest under Article 6(1)(f) of the GDPR. Information on the legal bases applicable in each individual case is provided in the following paragraphs of this privacy policy.

Data protection officer

We have appointed a data protection officer.
Priolan GmbH
Steinsfeldstr. 46
74626 Bretzfeld
Germany
<link mailto:Datenschutz@schlosshohenkammer.de>E-mail</link

Recipients of personal data

In the context of our business activities, we work with various external bodies. In some cases, it is also necessary to transfer personal data to these external bodies. We only pass on personal data to external bodies if this is necessary in the context of the performance of a contract, if we are legally obliged to do so (e.g. transfer of data to tax authorities), if we have a legitimate interest in accordance with Art. 6(1)(f) of the GDPR or if another legal basis permits the transfer of data. When using data processors, we only pass on our customers' personal data on the basis of a valid Data Processing Agreement. In the case of joint processing, a contract for joint processing shall be concluded.

Right to complain to the competent supervisory authority.

In the event of violations of the GDPR, the data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, their place of work or the place of the alleged violation. The right to lodge a complaint is without prejudice to other administrative or judicial remedies.

Right to data portability

You have the right to have the data which we process automatically based on your consent or for the performance of a contract issued to you or a third party in a machine-readable format. If you demand the direct transmission of data to a different controller, this will only occur to the extent that this is technically feasibly.

Access, rectification, and erasure

The applicable statutory regulations entitle you to the right at any time and free of charge to information on the personal data saved about you, its origin and recipients, the purpose of data processing and, where necessary, the right to the rectification or erasure of this data. Please feel free to contact us at any time regarding this matter or any other questions you may have about personal data.

Right to the restriction of processing

You have the right to request the restriction of the processing of your personal data. You can contact us at any time regarding this matter. The right to restrict processing exists in the following cases:

• If you dispute the accuracy of your personal data stored with us, we usually need time to verify this. For the duration of the audit, you have the right to request the restriction of the processing of your personal data.


• If the processing of your personal data has been/is unlawful, you can request the restriction of data processing instead of erasure.


• If we no longer require your personal data, but you need it to establish, exercise, or defend legal claims, you have the right to request the restriction of processing of your personal data instead of its erasure.


• If you have lodged an objection under Article 21(1) of the GDPR, a balancing of your interests against ours must be carried out. As long as it has not yet been determined whose interests prevail, you have the right to request the restriction of processing of your personal data.

Where you have restricted the processing of your personal data, such data may – with the exception of its storage – only be processed with your consent, or for the establishment, exercise, or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or of a Member State.

Hosting

We host the content of our website with the following provider:

External hosting

This website is hosted externally. The personal data collected on this website will be stored on the servers of the hosting provider(s). This may include, in particular, IP addresses, contact enquiries, meta-data and communication data, contractual data, contact details, names, website access logs, and other data generated via a website.

External hosting is carried out for the purpose of fulfilling a contract with our potential and existing customers (Article 6(1)(b) of the GDPR) and in the interest of a secure, fast and efficient provision of our online services by a professional provider (Article 6(1)(f) of the GDPR). Where corresponding consent has been requested, processing is carried out exclusively on the basis of Article 6(1)(a) of the GDPR and § 25(1) of the TDDDG, in so far as the consent includes the storage of cookies or access to information in the user’s device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent is revocable at any time.

Our hosting provider(s) will process your data only to the extent necessary to fulfil its performance obligations and will follow our instructions regarding this data.

We use the following hosting provider(s):
Cosmos Consulting Group IT-Services GmbH
Klenzestraße 23
80469 Munich
Germany

Data processing

We have entered into a Data Processing Agreement (DPA) for the use of the above-mentioned service. This is a contract required under data protection law, which ensures that the provider processes the personal data of our website visitors strictly in accordance with our instructions and in compliance with the GDPR.

Cookies

Our website uses so-called 'cookies'. Cookies are small data packets and do not cause any damage to your device. They are either stored temporarily for the duration of a session (session cookies) or permanently (permanent cookies) on your device. Session cookies are automatically deleted after the end of your visit. Permanent cookies remain stored on your device until you delete them yourself or they are automatically deleted by your web browser.

Cookies may come from us (first-party cookies) or from third-party companies (so-called third-party cookies). Third-party cookies allow the inclusion of certain third-party services within websites (e.g., payment service processing cookies).

Cookies have different functions. Many cookies are technically necessary, as certain website functions would not work without them (e.g. the shopping basket function or the display of videos). Other cookies may be used to evaluate user behaviour or for advertising purposes.

Cookies that are necessary to carry out the electronic communication process, to provide certain functions you wish to use (e.g. for the shopping basket function) or to optimise the website (e.g. cookies for measuring web audiences) are stored on the basis of Article 6(1)(f) of the GDPR (necessary cookies), unless another legal basis is specified. The website operator has a legitimate interest in the storage of necessary cookies for the technically error-free and optimised provision of its services. Where consent for the storage of cookies and comparable recognition technologies has been requested, processing is carried out exclusively on the basis of this consent (Article 6(1)(a) of the GDPR and § 25(1) of the TDDDG); the consent may be revoked at any time.

You can configure your bowser so that you are notified when cookies are placed and only permit cookies in certain circumstances, exclude cookies being accepted in certain circumstances or completely and activate the automatic deletion of cookies when closing your browser. When deactivating cookies, the functionality of this website may be limited.

You can find out which cookies and services are used on this website in this privacy statement.

Server log files

The provider of this website automatically collects and saves information in so-called 'server log files' which your browser passes on to us automatically. This information includes:

• Browser type and browser version
• The operating system being used
• Referred URL
• Host name of the accessing computer
• Time of server request
• IP address

This data is not compiled with other data sources.

This data is collected on the basis of Art. 6(1)(f) of the GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimisation of its website – the server log files must be recorded for this purpose.

SSL / TLS encryption

For security reasons and to protect the transmission of confidential content, such as orders or requests that you send to us as the site operator, this site uses SSL / TLS encryption. You can recognise an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the padlock symbol in your browser line.

If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

Contact form

If you us send us requests using the contact form, your information from the enquiry form will be stored by ourselves. This includes the contact data you provided in it, for the purpose of dealing with your request and in the event of further questions. We will not pass on this data without your consent.

The processing of this data is based on Article 6(1)(b) of the GDPR, provided that your enquiry is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, processing is based on our legitimate interest in the effective handling of enquiries addressed to us (Article 6(1)(f) of the GDPR) or on your consent (Article 6(1)(a) of the GDPR) where this has been requested; consent may be revoked at any time.

The data you enter in the contact form remains with us until you request its erasure, revoke your consent to its storage, or the purpose for data storage no longer applies (e.g. after your enquiry has been fully processed). Mandatory statutory provisions – in particular the periods for data retention – remain unaffected here.

Enquiries by email, telephone or fax

If you contact us by email, telephone or fax, your enquiry, including all personal data resulting from it (name, request), will be stored and processed by us for the purpose of processing your request. We will not pass on this data without your consent.

The processing of this data is based on Article 6(1)(b) of the GDPR, provided that your enquiry is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, processing is based on our legitimate interest in the effective handling of enquiries addressed to us (Article 6(1)(f) of the GDPR) or on your consent (Article 6(1)(a) of the GDPR) where this has been requested; consent may be revoked at any time.

The data you send to us via contact enquiries remains with us until you request its erasure, revoke your consent to its storage, or the purpose for data storage no longer applies (e.g. after your enquiry has been fully processed). Mandatory legal provisions – in particular statutory retention periods – remain unaffected.

We use rapidmail to send our newsletter. The provider is Positive Group Deutschland GmbH, Ingeborg-Krummer-Schroth-Straße 18a, 79106 Freiburg im Breisgau, Germany. In doing so, your email address as well as, where applicable, your name and other data provided by you upon registration, are processed in particular.

The processing takes place on the basis of your consent in accordance with Art. 6(1)(a) of the GDPR. Insofar as the legal requirements for advertising to existing customers exist, dispatch can also take place on the basis of § 7(3) of the German Act Against Unfair Competition (UWG). You can revoke your consent at any time with effect for the future; for this purpose, you can in particular use the ‘unsubscribe’ link in the newsletter.

rapidmail processes the data as a processor. We have concluded a Data Processing Agreement with the provider pursuant to Article 28 of the GDPR. According to the provider, the data will be stored in Germany.

The data stored for the newsletter will always be stored until you unsubscribe or until the purpose of processing ceases. Required blocking data or evidence data may furthermore be stored insofar as this is necessary to comply with statutory requirements.

For more information on data processing by rapidmail, visit this website (German language only).

Revoking your consent to data processing

Many data processing operations are only possible with your explicit consent. You can revoke consent that you have previously granted at any time. The legality of the data processing that occurred up to the time of revocation remains unaffected by the act of revocation.

Right to object to the collection of data in special cases and to direct advertising (Art. 21 of the GDPR)

IF THE DATA PROCESSING IS BASED ON ART. 6( 1)( E) OR (F) OF THE GDPR, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION; THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. THE RESPECTIVE LEGAL BASIS ON WHICH PROCESSING IS BASED CAN BE FOUND IN THIS PRIVACY STATEMENT. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR PERSONAL DATA UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS (OBJECTION PURSUANT TO ART. 21( 1) OF THE GDPR).

IF YOUR PERSONAL DATA IS PROCESSED FOR THE PURPOSE OF DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA FOR SUCH MARKETING; THIS ALSO APPLIES TO PROFILING INSOFAR AS IT IS RELATED TO SUCH DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA WILL SUBSEQUENTLY NO LONGER BE USED FOR THE PURPOSE OF DIRECT MARKETING (OBJECTION PURSUANT TO ART. 21( 2) OF THE GDPR).

MyFonts

This page uses MyFonts. These are fonts that are loaded into your browser when you visit our website in order to ensure a uniform typographic appearance when displaying the website. The provider is Monotype Imaging Holdings Inc., 600 Unicorn Park Drive, Woburn, Massachusetts 01801, USA.

In order to verify compliance with the license terms and the number of monthly page views, MyFonts transmits your IP address, along with the URL of our website and our contract data, to its servers in the United States. According to Monotype, your IP address will be anonymised immediately after transmission, so that no personal reference can be established (anonymisation).

For details, see Monotype’s Privacy Policy at this website.

The company is certified according to the EU-US Data Privacy Framework (DPF). The DPF is an agreement between the European Union and the United States to ensure compliance with European data protection standards for data processing in the United States. Every company certified under the DPF is committed to complying with these data protection standards. For more information, please contact the provider through this link.

vis.Tour – virtual castle tour

For our virtual castle tour we use vis.Tour from iTouring GmbH, Dennewartstraße 25–27, 52068 Aachen, Germany. The service enables a browser-based virtual tour of our buildings and event areas.

During use, technically necessary connection and log data are processed. According to the provider, no personal user profiles are created in the web applications and no user tracking technologies are used. In particular, the date and time, the URL, browser and operating system, as well as an anonymised IP address, are processed in server log files.

Processing is carried out on the basis of Article 6(1)(f) of the GDPR based on our legitimate interest in enabling prospective clients and guests to take an engaging digital tour of our premises. Insofar as consent is required for individual features, processing is carried out on the basis of Article 6(1)(a) of the GDPR and § 25(1) of the TDDDG.

For more information about iTouring's privacy policy, visit this website (German language only).

YouTube content on our website

Videos from YouTube may be included on individual web pages. The provider for users in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. External YouTube content will not be loaded until you explicitly share it. During loading, your IP address, device and browser information, as well as information about the page view, can be transmitted to Google or YouTube.

Integration is carried out on the basis of your consent pursuant to Article 6(1)(a) of the GDPR and § 25(1) of the TDDDG. Consent can be revoked at any time with effect for the future via the cookie or consent settings. For more information, visit this website.

OpenTable – reservations

We use the OpenTable service for online reservations. This allows you to perform straightforward booking via our website. OpenTable collects your personal information and passes on the necessary information for your reservation. We treat the data received from OpenTable with the highest degree of confidentiality. On this page you will find all the relevant information. If you have any questions about OpenTable's data processing and its purposes, please visit this website. For further enquiries regarding data processing by OpenTable, you can contact OpenTable, Inc. directly at 1 Montgomery St., Suite 700, San Francisco, CA 94104 USA, Tel.: +49 (0) 69 130 14 87 0, email: gastservice(at)opentable.de. You have the right to object to the processing of your data at any time. Once the purpose no longer applies or consent is withdrawn, we will of course delete your data from our systems to the extent that this is desired in coordination with OpenTable.

DIRS21 booking system

For online bookings via our website and channel management, we use DIRS21 from TourOnline AG, Borsigstraße 26, 73249 Wernau, Germany. Availability can be queried and rooms or offers can be booked via DIRS21.

In the case of a booking, in particular your name, address, contact details, arrival and departure times, booked services and, if necessary, other booking information provided by you will be processed. The booking data is automatically transmitted via DIRS21 or the channel switch to our property management system, Protel.

The processing is carried out for the implementation of pre-contractual measures and for the fulfilment of the accommodation contract on the basis of Art. 6(1)(b) of the GDPR. Insofar as statutory retention or evidence obligations exist, processing is additionally carried out on the basis of Article 6(1)(c) of the GDPR. Technically necessary cookies may be used to carry out the booking; technologies subject to consent are used only on the basis of your consent.

Further information regarding data processing by DIRS21 can be found at this website (German language only).

Bookings via external booking portals

If you book via external booking portals such as Booking.com, HRS, Expedia or comparable providers, the respective provider first collects your data under its own responsibility under data protection law. The booking and contact details required for making the booking are then transmitted to us via the connected sales channels or DIRS21.

For data processing on the respective booking portals, the data protection regulations of the respective provider additionally apply. After receipt of the booking, we process the data for the implementation of the accommodation contract in accordance with Art. 6(1)(b) of the GDPR.

Protel property management system (PMS)

We use the property management system Protel to centrally manage reservations and stays. There, we collate the master and contact data, reservation and stay data, booked services, billing data, payment status, as well as any requests or notes provided by you that are necessary for your stay.

Processing is carried out in particular for the performance of the accommodation contract pursuant to Article 6(1)(b) of the GDPR, for compliance with legal obligations pursuant to Article 6(1)(c) of the GDPR, and, to the extent necessary, on the basis of our legitimate interest in ensuring secure and efficient hotel operations pursuant to Article 6(1)(f) of the GDPR. From Protel, the required data is transmitted to the systems and service providers described below, insofar as this is necessary for the respective purpose.

STRAIV – digital registration form, online check-in and guest communication

For digital guest services, in particular the digital registration form, the online check-in and digital communication before and during a stay, we use the services of Straiv GmbH, Industriestraße 23, 70565 Stuttgart, Germany. The booking and guest data required for these functions are transferred from our property management system Protel to STRAIV.

In particular, master and contact data, booking and stay data, legally required registration data, as well as requests and enquiries communicated by you, can be processed. Customer requests and operational enquiries can be forwarded to hotelkit for internal processing via an interface.

Processing is carried out for the performance of the accommodation contract on the basis of Article 6(1)(b) of the GDPR and, insofar as statutory registration obligations are fulfilled, on the basis of Article 6(1)(c) of the GDPR. Insofar as individual functions require consent, the processing is carried out on the basis of Art. 6(1)(a) of the GDPR. STRAIV processes personal data, where agreed, as a processor pursuant to Article 28 of the GDPR.

Further information can be found in STRAIV's privacy policy at this website.

hotelkit – internal hotel organisation

We use hotelkit from hotelkit GmbH, Marie-Andeßner-Platz 1, 5020 Salzburg, Austria, for internal operational organisation and communication. Via the interface to STRAIV, necessary guest-related information may be transmitted to hotelkit insofar as this is required for processing guest requests, tasks, housekeeping processes or other operational procedures.

Only the data required for the particular operation is processed. The legal basis is Article 6(1)(b) of the GDPR insofar as processing is required for the performance of the accommodation contract and otherwise Article 6(1)(f) of the GDPR on the basis of our legitimate interest in efficient and service-oriented hotel organisation. hotelkit processes personal data on our behalf pursuant to Article 28 of the GDPR.

For more information on data protection at hotelkit, visit this website.

ASSA ABLOY access control system

For the creation and management of room key cards and access permissions, we use a locking and access control system provided by ASSA ABLOY. For this purpose, the information required for access from the reservation or room allocation is processed, in particular room assignment and the validity period of the authorisation. Processing is carried out for the performance of the accommodation contract pursuant to Article 6(1)(b) of the GDPR, as well as on the basis of our legitimate interest in secure access management pursuant to Article 6(1)(f) of the GDPR.

Matrix restaurant point-of-sale system

In our catering and dining areas, we use the Matrix point-of-sale system. In this context, order, turnover, and billing data are processed. If services are booked to a hotel room, this data can be linked to the respective booking in Protel. Processing is carried out for the performance of a contract pursuant to Article 6(1)(b) of the GDPR and to comply with statutory recording and retention obligations pursuant to Article 6(1)(c) of the GDPR.

Customer Alliance – guest surveys and reviews

We use the services of CA Customer Alliance GmbH, Hausvogteiplatz 12, 10117 Berlin, Germany, for guest surveys, quality assurance and review management. Following your stay, the required contact and stay details, in particular your name, email address, and travel dates, may be transferred from our property management system to Customer Alliance for this purpose.

Customer Alliance can then send you an invitation to submit a review. Reviews and feedback you provide are processed in the rating system and can – depending on the selected or set up publication function – be published on our website or on selected rating portals such as Google, HolidayCheck or TripAdvisor or transmitted there.

Processing is generally carried out on the basis of our legitimate interest in quality assurance and the improvement of our services pursuant to Article 6(1)(f) of the GDPR. Insofar as consent is required, processing is carried out on the basis of Article 6(1)(a) of the GDPR. The dispatch of review requests shall take place only insofar as a legal basis exists for this purpose under data protection and competition law.

Further information can be found in the privacy policy of Customer Alliance at this website.

Electronic payments

Electronic payments are processed through external payment service providers. In particular, we use VR Payment GmbH, Platz der Republik, 60325 Frankfurt am Main, Germany. The complete card or account data required for payment processing is processed directly by the respective payment service provider and is not stored in our own hotel systems.

We receive only the information necessary for the allocation, confirmation, and posting of the payment, in particular the payment amount, timestamp, payment status and, where applicable, a transaction reference. This information can be linked to the respective booking in Protel and our financial accounting system.

Processing is carried out for the performance of the contract pursuant to Article 6(1)(b) of the GDPR and, insofar as statutory retention or record-keeping obligations exist, pursuant to Article 6(1)(c) of the GDPR. Further information on data processing by VR Payment can be found at this website (German language only).

Billing and accounting data

Invoicing, turnover and payment information is transferred to our financial accounting department to the extent required and processed there for billing, controlling and compliance with commercial and tax law obligations. The legal bases are Art. 6(1)(b) and (c) GDPR. The data is stored in accordance with statutory retention periods.

Handling applicant data

We offer you the opportunity to submit a job application to us (e.g. by email or post). Below, we inform you regarding the scope, purpose and use of your personal data collected during the application process. We assure you that the collection, processing and use of your data takes place in accordance with applicable data protection law and all other statutory provisions, and that your data is treated as strictly confidential.

Scope and purpose of data collection

If you submit an application to us, we process your associated personal data (e.g. contact and communication details, application documents, notes taken during job interviews, etc.) insofar as this is necessary to reach a decision on establishing an employment relationship. The legal basis for this is § 26 of the German Federal Data Protection Act (BDSG) (initiation of an employment relationship), Article 6(1)(b) of the GDPR (general contract negotiation) and – where you have given consent – Article 6(1)(a) of the GDPR.) Consent is revocable at any time. Your personal data will only be shared within our company with persons who are involved in processing your application.

Where the application is successful, the data submitted by you is stored in our IT systems on the basis of § 26 of the BDSG and Article 6(1)(b) of the GDPR for the purpose of carrying out the employment relationship.

Data retention period

If we are unable to make you a job offer, you reject a job offer or you withdraw your application, we reserve the right to retain the data submitted by you on the basis of our legitimate interests (Article 6(1)(f) of the GDPR) for up to 6 months following the conclusion of the application process (rejection or withdrawal of the application). The data is then deleted and the physical application documents are destroyed. Retention is carried out primarily for proof purposes in the event of litigation. Where it is apparent that the data will be required after the 6-month period has expired (e.g. due to an impending or pending legal dispute), erasure only takes place when the purpose for further storage no longer applies.

Extended retention may also occur where you have given relevant consent (Article 6(1)(a) of the GDPR) or where statutory storage duties prevent deletion.

This privacy statement applies to the following social media sites:
— facebook.com/SchlossHohenkammer
— x.com/schlosshohenkam
— instagram.com/schloss_hohenkammer/
— linkedin.com/company/schloss-hohenkammer-gmbh
— youtube.com/channel/UC60byNJHXm6c-C9x6dkHC0Q
— TikTok

Data processing through social networks

We maintain publicly accessible profiles on social networks. Please see below for the specific social networks we use.

Social networks such as Facebook, X, etc. can generally comprehensively analyse your user behaviour when you visit their websites or a website with integrated social media content (e.g. like buttons or advertising banners). Visiting our social media pages and channels triggers numerous data protection-related processing operations. The next paragraph contains some specific examples.

If you are logged into your social media account and visit our social media pages and channels, the operator of the social media portal is able to assign this visit to your user account. However, your personal data may also be collected if you are not logged in or do not have an account with the respective social media portal. In this case, this data collection takes place, for example, via cookies that are stored on your device or by recording your IP address.

With the help of the data collected in this way, the operators of the social media portals can create user profiles in which your preferences and interests are stored. In this way, interest-based advertising can be displayed inside and outside the respective social media page or channel. If you have an account with the respective social network, the interest-based advertising can be displayed on all devices which you are or were logged in to.

Please also note that we are unable to trace all processing operations on the social media portals. Depending on the provider, further processing operations may therefore potentially be carried out by the operators of the social media portals. For details, please refer to the terms of use and data protection regulations of the respective social media portals.

Legal basis

Our social media channels are designed to guarantee as broad an online presence as possible. This is a legitimate interest within the meaning of Art. 6(1)(f) of the GDPR. The analysis processes initiated by the social networks may be based on different legal bases, which must be specified by the operators of the social networks (e.g. consent within the meaning of Art. 6(1)(a) of the GDPR).

Data controller and assertion of rights

If you visit one of our social media pages (e.g. Facebook), we are jointly responsible with the operator of the social media platform for the data processing operations triggered during this visit. In principle, you may assert your rights (access, rectification, erasure, restriction of processing, data portability and complaint) both against us and against the operator of the respective social media portal (e.g. against Facebook).

Please note that, despite joint responsibility with the social media portal operators, we do not have full influence over the data processing operations of the social media portals. Our options are based on the company policy of the respective provider.

Retention period

Data collected directly by us via the social media pages is erased from our systems as soon as you request erasure, revoke your consent to storage or the purpose for data storage no longer applies. Stored cookies remain on your device until you delete them. Mandatory statutory provisions – in particular the periods for data retention – remain unaffected here.

We have no influence over the retention period of your data that is stored by the operators of the social networks for their own purposes. For details on this, please contact the operators of the social networks directly (e.g. in their privacy policy, see below).

Your rights

You have the right to receive information on the origin, recipients and purpose of the personal data saved about you without charge at any time. You also have the right to object, to data portability and to lodge a complaint with the competent supervisory authority. Furthermore, you may demand the rectification, blocking, erasure and, under certain circumstances, the restriction of processing of your personal data.

Facebook

We have a Facebook page. The provider of this service is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (hereinafter referred to as Meta). According to Meta, the data collected will also be transferred to the USA and other third countries.

You can customise your ad settings on your own in your user account. To do this, click on the following link and log in: https://www.facebook.com/settings?tab=ads.

Data transmission to the USA is based on the standard contract clauses of the EU Commission. Details can be found here: https://www.facebook.com/legal/EU_data_transfer_addendum and https://www.facebook.com/help/566994660333381.

For details, see Facebook's privacy policy: https://www.facebook.com/about/privacy/.

The company is certified according to the EU-US Data Privacy Framework (DPF). The DPF is an agreement between the European Union and the United States to ensure compliance with European data protection standards for data processing in the United States. Every company certified under the DPF is committed to complying with these data protection standards. For more information, please contact the provider through the following link: https://www.dataprivacyframework.gov/s/participant-search/participant-detail?contact=true&id=a2zt0000000GnywAAC&status=Active

X (formerly Twitter)

We use the microblogging service X (formerly Twitter). The provider is Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland.

You can customise your X privacy settings independently in your user account. To do this, click on the following link and log in: https://twitter.com/personalization.

Data transmission to the USA is based on the standard contract clauses of the EU Commission. Details can be found here: https://gdpr.twitter.com/en/controller-to-controller-transfers.html.

For more details, please refer to the X privacy policy: https://twitter.com/de/privacy.

Instagram

We have an Instagram account. The provider of this service is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

Data transmission to the USA is based on the standard contract clauses of the EU Commission. Details can be found here: https://www.facebook.com/legal/EU_data_transfer_addendum, https://privacycenter.instagram.com/policy/ and https://www.facebook.com/help/566994660333381.

For details on how your personal data is handled, see the Instagram privacy policy: https://privacycenter.instagram.com/policy/.

The company is certified according to the EU-US Data Privacy Framework (DPF). The DPF is an agreement between the European Union and the United States to ensure compliance with European data protection standards for data processing in the United States. Every company certified under the DPF is committed to complying with these data protection standards. For more information, please contact the provider through the following link: https://www.dataprivacyframework.gov/s/participant-search/participant-detail?contact=true&id=a2zt0000000GnywAAC&status=Active

LinkedIn

We have a profile on LinkedIn. The provider is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. LinkedIn uses advertising cookies.

If you would like to disable LinkedIn advertising cookies, please use the following link: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

Data transmission to the USA is based on the standard contract clauses of the EU Commission. Details can be found here: https://www.linkedin.com/legal/l/dpa and https://www.linkedin.com/legal/l/eu-sccs.

For details on how your personal data is handled, please refer to LinkedIn's privacy policy: https://www.linkedin.com/legal/privacy-policy.

YouTube

We have a YouTube channel. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. For details on how your personal data is handled, please refer to YouTube's privacy policy: https://policies.google.com/privacy?hl=.

The company is certified according to the EU-US Data Privacy Framework (DPF). The DPF is an agreement between the European Union and the United States to ensure compliance with European data protection standards for data processing in the United States. Every company certified under the DPF is committed to complying with these data protection standards. For more information, please contact the provider through the following link: https://www.dataprivacyframework.gov/s/participant-search/participant-detail?contact=true&id=a2zt000000001L5AAI&status=Active

TikTok

We have a TikTok account. For users in the European Economic Area, the service is provided by TikTok Technology Limited, Dublin, Ireland, among others. When visiting our TikTok profile, TikTok may process personal data, in particular device, usage and interaction data, and assign it to your TikTok account, provided you are logged in there.

TikTok may also process personal data outside the European Economic Area. We have only limited influence over the scope, purposes and retention period of data processing by TikTok. Details of this and the protection measures used by TikTok can be found in the TikTok privacy policy at https://www.tiktok.com/legal/page/eea/privacy-policy/en

Mr Sascha Tischendorf
Priolan GmbH
Steinsfeldstraße 46
74626 Bretzfeld
Germany
<link mailto:Datenschutz@schlosshohenkammer.de>E-mail</link

• Headers are not consistently structured in a logical, descending order
• Some graphical control elements are insufficiently labelled
• Some links do not have clearly recognisable names
• Some document titles are not self-explanatory
• Not all HTML code complies with the W3C recommendations
• Content in “Leichte Sprache” (easy language) and German sign language is currently not available