Privacy Policy

Privacy Policy for Sweepstakes on Facebook & Instagram

 

1. Data Protection at a Glance

 

General Information

The following notes provide a simple overview of what happens to your personal data when you visit our website.
Personal data is any data that can be used to personally identify you.
Detailed information can be found in the full privacy policy below.

Data Collection on Our Website

Who is responsible for data collection on this website?
Data processing is carried out by the website operator. You can find the contact details in the imprint.

How do we collect your data?

  • Data you provide directly (e.g., via a contact form)

  • Technical data collected automatically (e.g., browser, operating system, time of visit)

What do we use your data for?
Some data is collected to ensure the proper functioning of the website.

What rights do you have regarding your data?

  • Right of access

  • Right to rectification

  • Right to blocking

  • Right to deletion

  • Right to restriction of processing

  • Right to lodge a complaint with the competent authority

2. General Notes and Mandatory Information

 

Data Protection

We treat your personal data confidentially and in accordance with legal data protection regulations.
Please note that data transmission over the internet (e.g., email communication) may have security vulnerabilities.

Responsible Party

TOPassau GmbH & Co. KG
Stefan Heusler
Hermann-Mayrhofer-Str. 15
94036 Passau
Telefon: +49 176 20801965
E-Mail: info@topassau.de

Revocation of Your Consent to Data Processing

You may revoke your consent at any time by sending us an informal email.
The legality of the data processing carried out until the revocation remains unaffected.

Right to Object (Art. 21 GDPR)

You have the right to object to data processing based on:

  • Article 6(1)(e) or (f) GDPR

  • Direct marketing, including profiling related to such marketing

Right to File Complaints with Supervisory Authorities

You have the right to lodge a complaint with a data protection authority.

Right to Data Portability

You can request that we hand over data you provided in a machine-readable format.

SSL/TLS Encryption

This site uses SSL or TLS encryption for security.
You can recognize this by the “https://” in the address bar and the lock icon in your browser.

Encrypted Payments

If we ask for payment details, they will be transmitted exclusively via encrypted connections.

Right of Access, Blocking, Deletion, Correction

You have the right to receive free information about your stored data and to request its correction, blocking or deletion.

Right to Restrict Processing

This applies if, for example:

  • You contest the accuracy of the data

  • Processing is unlawful

  • You have objected under Art. 21 GDPR

Right to Object to Promotional Emails

We hereby explicitly object to the use of our contact data for unsolicited advertising.

3. Data Collection on Our Website

Consent Management (Cookie Banner)

Our website uses a consent management system (cookie consent banner) to obtain and document your consent to the storage of certain cookies and the use of specific technologies in accordance with Article 6(1)(a) GDPR and Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TTDSG).

When you visit our website for the first time, you can decide whether you wish to consent to the use of analytics and marketing services. Your selection is stored locally in your browser and can be changed or withdrawn at any time via the “Cookie Settings” link.

The legal basis for the processing is Article 6(1)(a) GDPR.

Google Tag Manager

We use Google Tag Manager provided by

Google Ireland Limited
Gordon House, Barrow Street
Dublin 4
Ireland.

Google Tag Manager is used exclusively for the management and deployment of website tags. Google Tag Manager itself does not create user profiles or set analytics cookies.

Google Tag Manager is only loaded on our website after you have given your explicit consent via our consent management system. Before your consent is given, the service is not loaded.

The legal basis for the processing is your consent in accordance with Article 6(1)(a) GDPR.

Further information can be found at:

https://support.google.com/tagmanager

and

https://policies.google.com/privacy

Google Analytics

If you have given your consent, we use Google Analytics, a web analytics service provided by Google Ireland Limited.

Google Analytics uses cookies that enable an analysis of your use of our website. The information collected in this way may be transmitted to and processed on Google’s servers.

We use Google Analytics only after you have given your explicit consent.

The processing is based on Article 6(1)(a) GDPR.

You may withdraw your consent at any time via the Cookie Settings.

Further information:

https://policies.google.com/privacy

Google Consent Mode

To implement your cookie settings, we use Google Consent Mode.

This ensures that analytics and marketing services are activated only in accordance with the consent you have provided.

Before your consent is given, these services are not loaded.


Meta Pixel (Meta Platforms Ireland Limited)
We use the Meta Pixel service (formerly Facebook Pixel) provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (parent company: Meta Platforms, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA) on our website.

Purpose of Data Processing
The Meta Pixel enables Meta to identify visitors to our website as a target audience for the display of advertisements (so-called “Meta Ads” or “Facebook/Instagram Ads”). Accordingly, we use the Meta Pixel to display the Meta Ads placed by us only to users who have shown an interest in our online offering or who exhibit certain characteristics (e.g. interests in specific topics or products determined on the basis of websites visited; so-called “Custom Audiences”).

Furthermore, the Meta Pixel enables us to measure the effectiveness of our advertisements for statistical and market research purposes by allowing us to determine whether users were redirected to our website after clicking on an advertisement (so-called “Conversion Tracking”).

Data Collected and Storage Period
When you visit our website, the Meta Pixel collects, among other things, the following data:
IP address (truncated/anonymized)
HTTP header information (browser type, operating system, referrer URL)

Device Data and Location Information
Specific interactions and events on our website (e.g. page views, completed purchases, button clicks)
Meta user ID / cookie data (for assignment to the respective Meta user account)

Storage period: The data collected and processed via the Meta Pixel is stored by us and/or Meta for a period of up to 180 days and is subsequently automatically deleted or anonymized, unless statutory retention obligations require otherwise.

Legal Basis
Your data is processed exclusively on the basis of your explicit consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG (storage of cookies / access to information on terminal devices). You may withdraw your consent at any time with effect for the future via our cookie settings.

Transfer to Third Countries
The collected data may be transferred to servers of Meta Platforms, Inc. in the USA. Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework (DPF), thereby ensuring a level of protection considered adequate under European data protection law.

Withdrawal of Consent and Right to Object (Opt-Out)
You may withdraw your consent to data collection via the Meta Pixel and the use of your data for the display of advertisements at any time:
Via the cookie settings on our website.
For logged-in Meta users, directly via the advertising settings on Facebook at https://www.facebook.com/settings?tab=ads.

Google Ads Tag & Conversion Tracking
Our website uses the Google Ads online advertising program as well as the associated Conversion Tracking service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA).

Purpose of Data Processing
We use Google Ads Conversion Tracking to specifically measure and optimize the use and effectiveness of our advertisements. When you click on an advertisement placed by Google, a tag or cookie for conversion tracking is stored on your device. If you subsequently visit certain pages of our website while the cookie is still valid, Google and we can recognize that you clicked on the advertisement and were redirected to our website.

Each Google Ads customer receives a different cookie. The cookies therefore cannot be tracked across the websites of different Google Ads customers. The information obtained is used to generate conversion statistics for us. We are informed of the total number of users who clicked on our advertisement and were redirected to a page containing a conversion tracking tag. However, we do not receive any information that allows us to personally identify individual users.

Data Collected and Storage Period
As part of Conversion Tracking, Google processes, among other things:
IP address
Online identifiers (e.g. cookie IDs, advertising IDs)
Click behavior relating to advertising elements and destination pages visited
Browser and device information as well as timestamps

Storage period: Cookies set for Conversion Tracking generally expire after 30 to 90 days.

Legal Basis
Google Ads Conversion Tracking is used exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Consent is provided via our cookie consent banner and may be freely withdrawn at any time.

Transfer to Third Countries
When using Google Ads, data may be transferred to servers operated by Google LLC in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework (DPF).

Withdrawal of Consent and Right to Object (Opt-Out)
You can prevent or disable the storage of cookies by adjusting the relevant settings in your browser or via our cookie consent tool. In addition, you can disable personalized advertising in Google’s advertising settings at https://adssettings.google.com.

Local Storage

We use your browser’s Local Storage to save your cookie settings.

Only your selected consent preferences are stored.

This storage is used to restore your privacy settings when you revisit our website.

The data remains exclusively on your device and is not transmitted to third parties.

The legal basis is Article 6(1)(c) GDPR and Article 6(1)(f) GDPR.

Legal basis:
Article 6(1)(f) GDPR (legitimate interest)

Server Log Files

Collected automatically:

  • Browser type and version

  • Operating system

  • Referrer URL

  • Time of server request

No merging of this data with other sources.

Contact Form

Data entered in the contact form will be stored to:

  • Process your request

  • Follow up if necessary

Legal basis:
Your consent (Art. 6(1)(a) GDPR) – can be withdrawn at any time

Contact by Email, Phone, or Fax

All inquiries may include personal data for processing.
Legal basis:

  • Art. 6(1)(b) GDPR (contract initiation)

  • Art. 6(1)(a) or (f) GDPR (consent / legitimate interest)

Customer and Contract Data Processing

We process personal data only when necessary to fulfill a contract.
Legal basis: Art. 6(1)(b) GDPR

Data Transfer upon Contract Conclusion

Data may be shared with:

  • Payment providers (e.g., banks)

No transfer of data for advertising without your consent.

4. AI-Powered Chat Assistant

4. AI-powered Chat Assistant

We use an AI-powered chat assistant on our website to respond to visitor inquiries and facilitate access to information.

When using the chat assistant, the content entered by the user is processed and stored on servers in order to provide the chat history and ensure the proper functioning of the system. Use of the chat assistant is voluntary.

Personal data is only processed if it is provided by the user within the chat. The content is not analyzed for our own purposes or used for marketing activities. No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place.

Processing is carried out for the implementation of pre-contractual measures and for responding to inquiries in accordance with Art. 6 (1) lit. b GDPR or on the basis of legitimate interests pursuant to Art. 6 (1) lit. f GDPR.

For the technical implementation of the chat assistant, an external AI service is used via an application programming interface (API). The transmitted content is not used to train the AI with personal data.

Chat histories can be deleted upon request. Communication is encrypted (SSL/TLS).