Privacy Policy

I. Preamble

For us, a trusting partnership begins with the little things. Naturally, this also includes protecting your data from the very beginning. With this Privacy Policy, we would therefore like to inform you about the nature, scope, and purpose of the processing of your personal data that occurs when you visit our website and that we use, in part, to make our services as convenient as possible for our customers.

In doing so, we adhere to the provisions of the European Union’s General Data Protection Regulation (hereinafter: GDPR), the German Federal Data Protection Act (hereinafter: BDSG), and the German Telemedia Act (hereinafter: TMG).

II. General Information

a. Data Controller
The data controller as defined by the GDPR is:
GLC Glücksburg Consulting AG
represented by the Executive Board: Prof. Martin Weigel
Albert-Einstein-Ring 5
D-22761 Hamburg
Phone: 040 – 85 40 06-0
Fax: 040 – 85 40 06-38
Email: info@glc-group.com
www.glc-group.com

b. Data Protection Officer
External Data Protection Officer (eDSB)
ARCONDA SYSTEMS AG
Frank Espenhain
Sportallee 6
22335 Hamburg / Germany
Tel.: +49-40-823158-0
Fax: +49-40-823158-99
Email: F.Espenhain(at)Arconda.ag

c. Terminology
The terminology used in this Privacy Policy corresponds to that of the GDPR and the BDSG. The key terms are:

• “personal data”: any information relating to an identified or identifiable natural person (hereinafter referred to as the “data subject”); a natural person is considered identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more specific characteristics that reflect the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person (Art. 4(1) GDPR);
• “Processing”: any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, distribution, or any other form of making available, the matching or linking, the restriction, erasure, or destruction (Art. 4(2) GDPR);
• “Third party” means a natural or legal person, public authority, agency, or other body, other than the data subject, the controller, the processor, and the persons who, under the direct authority of the controller or the processor, are authorized to process the personal data (Art. 4(10) GDPR);
• “Consent”: any freely given, specific, informed, and unambiguous indication of the data subject’s wishes, expressed by a statement or by a clear affirmative action, by which the data subject indicates that he or she consents to the processing of personal data relating to him or her (Art. 4(11) of the GDPR).

d. Types of Data
On our website, we process the following types of data in particular:

• Master data (data necessary for establishing, defining the terms of, modifying, or terminating a contractual relationship; e.g., name and address)
• Contact information (information that allows us to reach you or your company; for example, email address or phone number)
• Content Data (Content of transmitted messages; e.g., text you enter, images, videos)
• Usage data (technical information such as access times and websites visited)
• Communication data (data that provides us with information about the communication channel, such as the browser you use, device information, and IP addresses)
  The following additional types of data are collected in the context of business-related processing:
• Contract details (the contract text and subject matter, term, etc.)
• Payment information (e.g., bank account information and transaction history)

e. Data Subject Groups & General Purpose of Processing
We collect personal data from users of this website. The data collected from you is processed to provide this website and to respond to contact requests. In addition, we collect certain data for the purpose of measuring reach and to make our offerings even more attractive to our customers. For specific details on what data is collected, the legal basis for such collection, and how we process it, please refer to the relevant sections throughout this Privacy Policy.

f. Right to Withdraw Consent
You naturally have the right to withdraw your consent at any time, without providing a reason, in accordance with Article 7(3) of the GDPR, with effect for the future. The withdrawal is not subject to any specific form and becomes effective upon receipt, regardless of the medium used, and will be honored by us. However, to make things easier for both you and us, we ask that you send your withdrawal to the following email address: datenschutz@glc-group.com.

g. Cookies
Virtually all websites today use various cookies to ensure that the respective pages function as intended and that the design and features are displayed optimally for you. Cookies are information files that are transmitted from our web server or third-party web servers to your web browser and stored there. They are stored there for later retrieval. These information files contain specific details related to your device (PC, smartphone, and browser). However, this does not mean that we thereby gain direct knowledge of your identity. Cookies primarily serve to enhance the user-friendliness of websites (e.g., by storing login information or language preferences). Cookies do not cause any damage to your device and do not contain viruses, Trojans, or other malware.

What types of “cookies” do we use?
This website uses session and persistent cookies; their scope and functionality are explained below:

• Transient cookies are automatically deleted when you close your browser. These include, in particular, session cookies. These cookies store a so-called session ID, which allows us to associate various requests from your browser with the same session. This enables us to recognize your computer when you return to our website. We therefore use these cookies to identify you for subsequent visits if you have an account with us. Otherwise, you would have to log in again for each visit. Session cookies are deleted when you log out or close your browser.
• Persistent cookies are automatically deleted after a specified period, which may vary depending on the cookie. You can delete these cookies at any time in your browser’s security settings.

What can I do to prevent the use of cookies?
Most browsers automatically accept cookies. If you do not want cookies to be stored on your computer, you can disable this option in your browser’s settings. Stored cookies can also be deleted in your browser’s settings. However, disabling cookies may result in limited functionality of this website. You can find information on how to disable cookies in the most common browsers by following the links below:

Google Chrome: https://support.google.com/accounts/answer/61416?hl=de
Microsoft Internet Explorer: https://support.microsoft.com/de-de/help/17442/windows-internet-explorer-delete-manage-cookies
Safari: https://support.apple.com/kb/PH19214?locale=de_DE&viewlocale=de_DE
Firefox: https://support.mozilla.org/de/kb/cookies-erlauben-und-ablehnen
Opera: https://help.opera.com/de/latest/web-preferences/

h. General (Marketing) Objection
Please note that, regardless of whether you visit our website, you always have the right to object to the processing of your personal data in accordance with Article 21 of the GDPR.

You also have the right to object to the processing of your personal data for direct marketing purposes pursuant to Article 21(2) of the GDPR. The objection is not subject to any specific form and becomes effective upon receipt, regardless of the medium used, and will be honored by us. However, to make things easier for both you and us, we ask that you send your objection to the following email address: datenschutz(at)glc-group.com.

i. General Deletion and Blocking Policy
We delete or block your personal data in accordance with Articles 17 and 18 of the GDPR. In particular, we will delete the data as soon as the purpose for which we originally collected it no longer applies and there are no legal retention obligations. For example, we are legally required under Section 257(1) of the German Commercial Code (HGB) to retain trade ledgers, inventories, opening balance sheets, annual financial statements, individual financial statements pursuant to Section 325(2a), management reports, consolidated financial statements, group management reports, as well as the work instructions and other organizational documents necessary for their understanding, business correspondence, and accounting vouchers for a period of 6 years. In the case of statutory retention obligations, we restrict access to the data so that we will process it exclusively for the purpose prescribed by law.

j. Data Security
To ensure the security of your data, we use the widely adopted Secure Sockets Layer (SSL) protocol to transmit both website content and the data you enter. The data transmitted between you and our hosting provider is encrypted using 256-bit encryption. If your browser does not support 256-bit encryption, we will use 128-bit v3 technology instead.

III. Your Rights

The purpose of our efforts to protect your data is always to ensure that you have complete control over the information you provide. In addition to the rights outlined above, you therefore have further rights regarding the personal data we hold about you, which we are pleased to describe in detail below.

a. Right to Confirmation of Processing
Pursuant to Article 15 of the GDPR, you have the right to receive confirmation from us regarding the processing of your personal data.

b. Right of Access
If we process your personal data, you also have the right, pursuant to Art. 15 of the GDPR, to know what data we hold about you. We will provide you with this information in accordance with the provisions of Art. 15 of the GDPR.

c. Right to Completion and Rectification
Pursuant to Article 16 of the GDPR, you have the right to request that we promptly correct any inaccurate personal data concerning you. In addition, you have the right to have any incomplete data we hold about you completed.

d. Right to Erasure
Pursuant to Article 17 of the GDPR, you have the right to request that we erase your personal data without delay, provided that one of the following conditions applies and there is no exception under Article 17(2) and (3) of the GDPR:

• The personal data is no longer necessary for the purposes for which it was collected or otherwise processed.
• The data subject withdraws the consent on which the processing was based pursuant to Article 6(1)(a) or Article 9(2)(a), and there is no other legal basis for the processing.
• The data subject objects to the processing pursuant to Article 21(1), and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2).
• The personal data was processed unlawfully.
• The erasure of personal data is necessary to comply with a legal obligation under Union law or the law of the Member States to which the controller is subject.
• The personal data was collected in connection with information society services offered in accordance with Article 8(1).

e. Right to Restriction of Processing
Pursuant to Article 18 of the GDPR, you have the right to request that we restrict the processing of your personal data without delay, provided that one of the following conditions is met:

• the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data,
• the processing is unlawful and the data subject objects to the erasure of the personal data and instead requests that the use of the personal data be restricted;
• the controller no longer needs the personal data for the purposes of processing, but the data subject needs it to assert, exercise, or defend legal claims, or
• the data subject has objected to the processing pursuant to Article 21(1), as long as it has not yet been determined whether the legitimate grounds of the controller override those of the data subject.

If processing has been restricted pursuant to paragraph 1, such personal data—with the exception of its storage—may be processed only with your consent, as the data subject, or for the purpose of asserting, exercise, or defense of legal claims; to protect the rights of another natural or legal person; or for reasons of a substantial public interest of the Union or a Member State. Before a restriction is lifted, we will notify you accordingly.

f. Right to Data Portability
Pursuant to Article 20 of the GDPR, you have the right to receive from us the personal data concerning you in a structured, commonly used, and machine-readable format, and to request that this data be provided to a third party without hindrance. Restrictions on this right may arise from Article 20 of the GDPR.

g. Right to File a Complaint
In accordance with Article 77 of the GDPR, you have the right to file a complaint with the competent supervisory authority. You can contact the competent authority at the following address: The Hamburg Commissioner for Data Protection and Freedom of Information, Klosterwall 6, 20095 Hamburg, Tel.: 040 428544040, Fax: 040 428 54 4000, Email: mailbox(at)datenschutz.hamburg.de.

IV. Processing for Technical Functionality Purposes

a. Hosting of the website
To make this website available to you, we work with a hosting provider. This provider supplies the infrastructure necessary for the smooth operation of this website and ensures, through regular maintenance, that your data is not lost. To ensure the protection of your data and compliance with data protection standards, we have also bound our hosting provider to uphold our high data protection standards under a data processing agreement in accordance with Article 28 of the GDPR. Based on our legitimate interest pursuant to Article 6(1)(f) of the GDPR in maintaining, operating, and securing this website, our hosting provider processes, on our behalf, the user data of this website’s users, including inventory, contact, content, contractual, usage, and communication data.

In addition, usage data is generated every time you visit our website. This data includes, in particular, the name of the website accessed, downloaded files, the date and time of the visit, the amount of data transferred in each instance, notifications confirming successful access to the website, the type of browser and operating system used, the previously visited page, the IP address, and the internet service provider used. We or our hosting provider process this data on our behalf and based on our legitimate interest pursuant to Art. 6(1)(f) of the GDPR in protecting against misuse and for security reasons. Personal data is stored for a period of 7 days and then automatically deleted, with the exception of data that must be retained for the purpose of preserving evidence.

b. Contacting Us via the Contact Form at
If you would like to contact us, please use our contact form. We process the data collected there for the purpose of handling your contact request in accordance with Article 6(1)(b) of the GDPR. If we remain in business contact with you thereafter, your personal data may also be processed in a relevant system as part of our customer relationship management. Once your inquiry has been answered and the data is no longer required, we will delete it, provided there are no legal archiving requirements.

Contacting Us via Email and Phone
When you contact us (by phone or email), your information will be processed to handle your inquiry and follow up on it in accordance with Article 6(1)(b) of the GDPR (necessary information in the context of pre-contractual measures) or in accordance with Article 6(1)(f) of the GDPR (legitimate interest in responding to your inquiry). If you contact us via email, we will also store the content you have sent us via email. If you provide us with information regarding communication channels (e.g., phone number), we may also contact you via that communication channel to address your inquiry. The personal data you provide will be used exclusively for the purpose for which you provided it when contacting us.

We delete the data we receive when you contact us as soon as it is no longer necessary to fulfill the purpose for which it was collected. This also applies to any information you provide voluntarily. It is in our legitimate interest to store this data together with the necessary data. For personal data sent via email or provided to us over the phone, the data is deleted once the respective conversation with the user has ended. The conversation is considered concluded when it is clear from the circumstances that the matter in question has been definitively resolved, but no later than 1 month after the last contact. If a contract is concluded with you, the statutory retention periods apply.

c. Data Protection for Job Applications and the Application Process
For the purpose of handling the application process, the data controller collects and processes the personal data of applicants. This processing may also be carried out electronically. This occurs primarily when an applicant submits the relevant application documents to the data controller digitally, for example via email. If an employment relationship subsequently arises between the data controller and the applicant, the transmitted data will be stored for the purpose of managing the employment relationship in accordance with legal requirements. The application documents are automatically deleted 6 months after notification of the rejection decision if no employment contract is concluded between the data controller and the applicant, provided that no other legitimate interests of the data controller preclude such deletion. Another legitimate interest in this context is, for example, the burden of proof in proceedings under the General Equal Treatment Act (AGG).

d. Booking Requests
On our website, you have the option to make online reservations for vacation rentals in the Bad Sachsa region of the Harz Mountains. We will process the personal data you provide to us with your request for the purpose of handling your request in accordance with Article 6(1)(b) of the GDPR. See Section IV of this Privacy Policy. See Section V(g) of this Privacy Policy.

e. Newsletter
If you would like to stay up to date on the latest products and information in the future, we invite you to subscribe to our email newsletter.

To ensure that no third party can sign up using your email address, the sign-up process is designed as a “double opt-in” procedure. After you enter your email address in the field provided and click the corresponding sign-up button, you will receive an email from us containing a link to confirm your registration. By clicking the link, you also give your consent to the further use of your personal data necessary for sending communications. For the purpose of verifiability, we log this registration and process the time of registration and confirmation, the IP address, and the email address provided based on our legitimate interest in verifying a registration pursuant to Article 6(1)(f) of the GDPR. We use the email address and name you provide to send the newsletter and to address you personally. We process this information based on your consent pursuant to Article 6(1)(a) and Article 7 of the GDPR in conjunction with Section 7(2)(3) of the German Unfair Competition Act (UWG), as well as based on the statutory authorization pursuant to Section 7(3) of the UWG.

If you no longer wish to receive the newsletter in the future, you can cancel your subscription at any time. You’ll find a link to unsubscribe at the bottom of every newsletter. Of course, you can also simply send us an email to the following address:

After termination, we may store your name and email address for up to 3 years based on our legitimate interest in being able to demonstrate that consent was previously given, in accordance with Article 6(1)(f) of the GDPR. The data is retained exclusively for this purpose and is blocked from use for any other purposes: info(at)bad-sachsa-urlaub.de.

f. Ordering Brochures
We provide brochures for you to order on our website. When you order them through our website, you provide us with your last name, first name, and address. We collect this data for processing purposes in accordance with Art. 6(1)(b) of the GDPR. Once the data is no longer needed after processing is complete, we will delete it.

V. Use of Third-Party Services – Technical Functionality and Information

Our website uses, among other things, tools provided by companies based in the United States. These tools may transfer your personal data to the respective companies’ servers in the United States. Under EU data protection law, the United States is not considered a safe third country, as U.S. companies are legally required to disclose personal data to U.S. security authorities upon request. Unfortunately, we have no control over the fact that U.S. authorities have access to your data stored on U.S. servers and may process, analyze, and store it.

a. Rapidmail
Description and Purpose: We use Rapidmail to send newsletters. The provider is Rapidmail GmbH, Wentzingerstraße 21, 79106 Freiburg, Germany. Among other things, Rapidmail is used to organize and analyze the distribution of newsletters. The data you provide for the purpose of subscribing to the newsletter is stored on Rapidmail’s servers in Germany. If you do not wish to have your data analyzed by Rapidmail, you must unsubscribe from the newsletter. We provide a link for this purpose in every newsletter message. You can also unsubscribe from the newsletter directly on the website. For analysis purposes, emails sent via rapidmail contain a so-called tracking pixel, which connects to rapidmail’s servers when the email is opened. This allows us to determine whether a newsletter message has been opened. Furthermore, with the help of RapidMail, we can determine whether and which links in the newsletter message are clicked. All links in the email are so-called tracking links, which allow us to count your clicks.

Legal Basis: The legal basis for data processing is Article 6(1)(a) of the GDPR.
Recipient: The recipient of the data is rapidmail GmbH.
Transfer to Third Countries: Data is not transferred to third countries.
Retention Period: The data you have provided to us as part of your consent to receive the newsletter will be stored by us until you unsubscribe from the newsletter and will be deleted from both our servers and RapidMail’s servers after you unsubscribe. Data stored by us for other purposes (e.g., email addresses for the members’ area) remains unaffected by this.
Right to Withdraw Consent: You may withdraw your consent to data processing at any time, effective for the future. The lawfulness of data processing operations that have already taken place remains unaffected by the withdrawal.
Additional Privacy Information: For more details, please refer to RapidMail’s privacy policy at: https://www.rapidmail.de/datensicherheit. For more information about RapidMail’s analytics features, please visit the following link: https://www.rapidmail.de/wissen-und-hilfe

b. Google Analytics
(1) This website uses Google Analytics, a web analytics service provided by Google Inc. (“Google”). Google Analytics uses so-called “cookies,” which are text files stored on your computer that enable an analysis of your use of the website. The information generated by the use of cookies regarding your use of this website is generally transmitted to a Google server in the United States and stored there. However, if IP anonymization is enabled on this website, your IP address will be truncated by Google beforehand within member states of the European Union or in other signatory states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the United States and truncated there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity, and to provide other services related to website and internet usage to the website operator.

(2) The IP address transmitted by your browser as part of Google Analytics is not combined with any other data held by Google.

(3) You can prevent cookies from being stored by adjusting your browser settings accordingly; however, please note that in this case, you may not be able to use all features of this website to their fullest extent. You can also prevent Google from collecting the data generated by the cookie and related to your use of the website (including your IP address), as well as from processing this data, by downloading and installing the browser plug-in available at the following link: http://tools.google.com/dlpage/gaoptout?hl=de.
(4) For data processing in connection with Google Analytics by Google, our company has entered into a data processing agreement with the service provider based on the EU Standard Data Protection Clauses.
(5) Third-party provider information: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001
Terms of Use: http://www.google.com/analytics/terms/de.html
Privacy Overview: http://www.google.com/intl/de/analytics/learn/privacy.html
Privacy Policy: http://www.google.de/intl/de/policies/privacy

c. Google AdWords Conversion Tracking
We also use Google Conversion Tracking on our website based on our legitimate interest in optimizing our website and determining the success of an advertising campaign in accordance with Article 6(1)(f) of the GDPR. The Google AdWords service places a cookie on your device if you have accessed our website via a link in a Google ad. The cookie is valid for 30 days and contains a unique identifier. As long as the cookie is valid, it can also be recognized by subsequent pages and used by Google for tracking. Using conversion tracking, Google can generate statistics for its AdWords customers that provide information about the total number of users who clicked on an ad and were redirected to a page tagged with a conversion. For more information on data protection in connection with Google’s conversion tracking, please visit http://services.google.com/sitestats/de.html.

d. Google Analytics Remarketing
We also use Google’s Google Analytics Remarketing service on our website based on our legitimate interest in personalized and target-group-oriented promotion of our offerings in accordance with Art. 6(1)(f) of the GDPR. In doing so, data from Google Analytics and AdWords may be combined. This allows us to display advertisements to you that we believe contain offers more relevant to you.

For more information on Google’s Terms of Service and Privacy Policy, visit http://www.google.com/analytics/terms/de.html or https://www.google.de/intl/de/policies/. For specific information on how Google Analytics Remarketing works, please visit: https://www.google.de/intl/de/analytics/features/remarketing.html.

e. Cloudflare – CDN
We use a service provided by Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107 (hereinafter: Cloudflare) on our website based on our legitimate interest in optimizing, ensuring the stability of, and protecting our online service from attacks. All requests to our website are also transmitted to Cloudflare’s servers in the United States. Cloudflare uses this data exclusively to maintain its service and guarantees that the data will not be disclosed to third parties.
For more information on Cloudflare’s Terms of Service and Privacy Policy, please visit www.cloudflare.com/terms/ or https://www.cloudflare.com/security-policy/.

f. DS Destination Solutions GmbH – A company of the HRS Group
We use the booking system of DS Destination Solutions GmbH, Breslauer Platz 4, 50668 Cologne (HRS DS) to arrange and book accommodations. When you make a booking on our website, you consent to the storage and processing of your personal data by HRS DS for the purpose of processing your booking. Your personal data will be forwarded to HRS DS and processed there. Furthermore, your data will be forwarded to the provider of the property that was booked. This storage and processing of data is carried out for the purpose of supporting and processing your booking and your authentication, as well as for billing purposes between HRS DS and GLC Glücksburg Consulting AG as the property provider’s intermediary partner. In the event of a booking, the data will be stored in accordance with the commercial retention period of 10 years.

For more information on the Terms of Use and Privacy Policy, as well as any third-party data processing contracted by HRS DS, please visit: https://www.im-web.de/impressum.php#datenschutz

g. Facebook Pixel

This website uses Facebook’s visitor action pixels to measure conversions. The provider of this service is Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. However, according to Facebook, the data collected
is also transferred to the United States and other third countries.This allows the behavior of site visitors to be tracked after they have been redirected to the provider’s website by clicking on a Facebook ad. This enables the effectiveness of Facebook ads to be evaluated for statistical and market research purposes and helps optimize future advertising campaigns.

The data collected is anonymous to us as the operator of this website; we cannot draw any conclusions about the identity of the users. However, the data is stored and processed by Facebook, which allows it to be linked to the respective user profile and enables Facebook to use the data for its own advertising purposes, in accordance with Facebook’s Data Use Policy. This enables Facebook to display advertisements on Facebook pages as well as outside of Facebook. As the site operator, we have no control over this use of the data.

The use of Facebook Pixel is based on Article 6(1)(f) of the GDPR. The website operator has a legitimate interest in effective advertising measures, including those on social media. If consent has been obtained, processing is carried out exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TTDSG, insofar as the consent covers the storage of cookies or access to information on the user’s device (e.g., device fingerprinting) within the meaning of the TTDSG. Consent may be revoked at any time.
Data transfers to the U.S. are based on the EU Commission’s Standard Contractual Clauses.

You can find details here: https://www.facebook.com/legal/EU_data_transfer_addendum and https://de-de.facebook.com/help/566994660333381.

To the extent that personal data is collected on our website using the tool described here and forwarded to Facebook, we and Facebook Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, are jointly responsible for this data processing (Art. 26 GDPR).

This joint responsibility is limited exclusively to the collection of data and its transfer to Facebook. The processing carried out by Facebook after the data has been transferred is not part of this joint responsibility. The obligations we share have been set forth in a joint processing agreement. The text of the agreement can be found at: https://www.facebook.com/legal/controller_addendum.

Under this agreement, we are responsible for providing privacy information regarding the use of the Facebook tool and for ensuring that the tool is implemented on our website in compliance with data protection laws. Facebook is responsible for the data security of Facebook products. You can exercise your rights as a data subject (e.g., requests for information) regarding the data processed by Facebook directly with Facebook. If you exercise your rights as a data subject with us, we are obligated to forward these requests to Facebook.

You can find more information about protecting your privacy in Facebook’s Privacy Policy: https://de-de.facebook.com/about/privacy/.

You can also use the “Custom Audiences” remarketing feature in the ad settings section at: https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen
, you must be logged into Facebook. If you do not have a Facebook account, you can disable usage-based advertising from Facebook on the European Interactive Digital Advertising Alliance website: http://www.youronlinechoices.com/de/praferenzmanagement/.

VI. Use of Third-Party Services – Social Bookmarks

Of course, bad-sachsa.de is also on Facebook and Instagram. To give you the opportunity to connect with us there, we’ve included links to these social media platforms. Clicking on the social media buttons will take you directly to our profile on the respective platform. This constitutes the use of an external link in accordance with the section “Declaration on Linking” in the legal notice.
As the operator of these corporate pages, we are jointly responsible with the operators of these networks within the meaning of Art. 4(7) of the GDPR. When you visit our company pages on social networks, personal data is processed by the respective data controllers.
Further information can be found in the privacy policies of the third-party providers:

• Facebook
• Instagram

VII. Privacy Policy for Online Sweepstakes

We appreciate your interest in our online sweepstakes. Protecting your personal information is very important to us. Below, we provide information about how we process your data in connection with our sweepstakes.

1. Data Controller
The data controller responsible for processing your data in connection with our online contests is
GLC Glücksburg Consulting AG
, represented by the Executive Board:
Prof. Martin Weigel on behalf of the Bad Sachsa Tourist Information Office in the Harz Mountains
Albert-Einstein-Ring 5
D-22761 Hamburg
Phone: 040 – 85 40 06-0
Fax: 040 – 85 40 06-38
Email: info@glc-group.com
www.glc-group.com

2. Collection and Processing of Personal Data

a) When you participate in our online contests, we collect the following personal data:
– Name
– Email address
– Phone number (optional)
– Address (optional)
– Date of birth (optional)

This information will be used exclusively for the purpose of conducting the sweepstakes. It will be used to contact you if you win and to ensure that the sweepstakes is conducted properly.

b) Your data will be processed exclusively by the contest organizer. It will not be disclosed to third parties unless this is necessary for the conduct of the contest. If you win a prize, the data necessary to provide the prize will be shared with the relevant partner. These partners are carefully selected by us and are obligated to treat your data confidentially and to use it solely for the purpose of administering the contest.

3. Retention Period
Your personal data will be deleted upon completion of the sweepstakes, unless there are legal retention requirements or you have expressly consented to the continued use of your data.

4. Your Rights
You have the right to request information about the processing of your personal data, as well as the right to have your data corrected, deleted, or to restrict its processing. In addition, you have the right to object to the processing of your data and the right to data portability.
To exercise your rights or if you have questions regarding the processing of your data, please contact:
GLC Glücksburg Consulting AG
represented by the Executive Board:
Prof. Martin Weigel on behalf of the Tourist Information Offices of Bad Sachsa in the Harz Mountains
Albert-Einstein-Ring 5
D-22761 Hamburg
Phone: 040 – 85 40 06-0
Fax: 040 – 85 40 06-38
Email: info@glc-group.com
www.glc-group.com

5. Updates to the Privacy Policy
This Privacy Policy may be updated to reflect changes in our privacy practices.

VIII. Current Status and Changes to This Privacy Policy

Due to ongoing developments on our website and in our services, as well as legal requirements, it may become necessary to amend this Privacy Policy at any time. We therefore recommend that you visit this page regularly to stay informed of any changes.

As of May 1, 2026