Privacy Policy Webshop
Veranstaltungs- und Kongress GmbH Rosenheim (VKR) - Ausstellungszentrum Lokschuppen
1. General Information
Protecting your privacy when processing personal data is a top priority for us. Veranstaltungs- und Kongress GmbH Rosenheim handles your personal data responsibly and manages it in accordance with applicable legal regulations. VKR and all persons involved in data processing are obligated to treat your data confidentially in accordance with the Federal Data Protection Act and other relevant data protection laws.When you place a ticket order or make a reservation in the online store, your data (name, address, phone number, email address, payment information) is collected, stored, processed, and used for the purpose of processing the ticket order, the reservation, and the electronic delivery of tickets. Your data is shared with project participants and consultation with project participants and staff, as well as for day-to-day organizational purposes. Your data will not be disclosed to third parties for advertising purposes. Your data will be transferred to data processors and service providers and processed in the following systems: Amepheas GmbH (point-of-sale software, online store software, and online store hosting), Büro Lokschuppen for printing and filing documents, freelance educational specialists, LOK 1858 Rosenheim, VKR servers, and in Microsoft 365 applications including SharePoint. Technical administration and support for the server and Microsoft 365 environment are provided by the IT department of the City of Rosenheim.
To process payments in our online store, we use the payment service provider Adyen N.V., Simon Carmiggeltstraat 6-50, 1011 DJ Amsterdam, Netherlands. Depending on the payment method you select, the personal data required for payment processing will be transmitted to Adyen and the respective payment service providers involved. Adyen processes the data primarily to execute the payment, prevent fraud, comply with legal obligations, and ensure the security of payment transactions. The data processed may include, in particular: first and last name, billing and shipping addresses, email address, phone number, order and transaction data, payment information, IP address, device and connection data, and fraud prevention and risk assessment data. The processing is carried out to implement pre-contractual measures and to fulfill the contract pursuant to Art. 6(1)(b) of the GDPR, as well as based on legal obligations pursuant to Art. 6(1)(c) of the GDPR and legitimate interests in secure and fraud-free payment processing pursuant to Art. 6(1)(f) of the GDPR. For more information on data protection at Adyen, please visit: https://www.adyen.com/privacy-policy
If you choose to pay via Klarna, the personal data required for payment processing will be transmitted via Adyen to Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. This is for the purpose of processing the payment and, if applicable, determining whether certain Klarna payment methods can be offered to you. In particular, the following data may be processed for this purpose: name, address, email address, phone number, date of birth (if required), order value, order history, payment information, transaction data. Klarna processes the data it receives under its own responsibility under data protection law. Depending on the selected payment method, Klarna may conduct risk assessments, identity checks, or credit assessments to the extent permitted by law and deemed necessary for the respective payment method. The legal basis for the transfer of data is Article 6(1)(b) of the GDPR, insofar as the processing is necessary for the performance of the contract or for the implementation of pre-contractual measures. Further information on data processing by Klarna can be found at: https://www.klarna.com/de/datenschutz/
If you select Apple Pay as your payment method, payment processing is handled by Adyen in conjunction with Apple Pay, a service provided by Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. Depending on the payment method and technical setup, payment and transaction data are transmitted to Apple as well as to the financial service providers involved in the payment. When using Apple Pay, the following data in particular may be processed: device information, transaction data, payment information in tokenized form, order value, merchant information, and transaction times. The processing is carried out to execute the payment transaction and thus to fulfill the contract in accordance with Art. 6(1)(b) of the GDPR. It cannot be ruled out that, in the course of providing the service, personal data may be transferred to companies within the Apple Group outside the European Economic Area. To the extent that such a transfer occurs, it is based on the data protection safeguards implemented by Apple in accordance with the requirements of the GDPR. Please note that Apple processes the data in part under its own data protection responsibility. For more information, visit: https://www.apple.com/legal/privacy/
If you use Google Pay as your payment method, payment processing is handled by Adyen in conjunction with Google Pay, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. To process the payment, personal data may be transmitted to Google as well as to the relevant payment and credit card providers. In particular, the following data may be processed: device information, transaction data, payment information in tokenized form, order value, merchant information, IP address, usage and security data. The processing is carried out to execute the payment transaction and thus to fulfill the contract in accordance with Art. 6(1) (b) of the GDPR. When using Google Pay, it cannot be ruled out that personal data may be transferred to companies within the Google Group outside the European Economic Area. To the extent that such transfers occur, they are based on the data protection safeguards implemented by Google in accordance with the requirements of the GDPR. Google processes certain data under its own data protection responsibility. Further information on data protection at Google can be found at: https://policies.google.com/privacy
Note on Transfers to Third Countries: In the course of payment processing, the transfer of personal data to recipients in countries outside the European Union or the European Economic Area cannot be ruled out. To the extent that such transfers occur, appropriate safeguards will be implemented in accordance with Art. 44 et seq. of the GDPR.
The duration of data storage depends on whether you have a one-time or recurring contractual relationship with VKR. Upon termination of the contractual relationship, your data will be deleted as soon as there are no longer any legal or contractual retention obligations.
2. Use of Cookies
We use cookies to optimize the content on our website. These are small files that are sent from a web server to your browser and are transmitted back by your browser each time you visit one of our pages. The stored data is collected for market research and to tailor our offerings to your needs, and is used exclusively for this purpose. Furthermore, cookies are used to process technical browser data by the payment processor, for fraud prevention and risk analysis, and to support secure payment processing. For all our analyses, cookie information is used exclusively without any link to your personal data—that is, it is completely anonymized. Please also note that you can configure your browser so that you do not receive cookies or so that you receive a notification when a cookie is about to be set. Cookies are set for:• Google Analytics incl. E-Commerce-Tracking: Ref. 3.
• Adyen (payment provider) - safety-related cookies: _RP_UID. Domain: checkoutshopper-live.adyen.com. Purpose: Recognition for Fraud Detection and Identification of Suspicious Purchasing Activities. Duration: 30 days. _cfuvid. Domain: checkoutshopper-live.adyen.com. Purpose: Cloudflare security cookie used to distinguish between users with the same IP address. Duration: Browsersitzung
3. Google Analytics e-commerce & Tag Manager
This website uses Google Analytics, a web analytics service provided by Google Inc. (“Google”). Google Analytics uses so-called “cookies,” which are text files stored on your computer that enable an analysis of your use of the website. The information generated by the cookie regarding your use of this website is generally transmitted to and stored on a Google server in the United States. However, if IP anonymization is enabled on this website, your IP address will be truncated by Google beforehand within member states of the European Union or in other signatory states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the United States and truncated there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity, and to provide other services related to website and internet usage to the website operator. The IP address transmitted by your browser as part of Google Analytics is not combined with other data held by Google. You can prevent the storage of cookies by adjusting your browser settings accordingly; However, please note that in this case, you may not be able to use all features of this website to their full extent. You can also prevent Google from collecting the data generated by the cookie and related to your use of the website (including your IP address), as well as from processing this data, by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=de This allows you to prevent data collection by Google Analytics. An opt-out cookie will be set to prevent the future collection of your data when you visit this website. For more information on terms of use and privacy, please visit https://policies.google.com/?hl=de. Please note that on this website, Google Analytics has been extended with the “anonymizeIp” code to ensure the anonymized collection of IP addresses (so-called IP masking). Source: www.datenschutzbeauftragter-info.deThis website uses the “E-commerce Tracking” feature of Google Analytics. With the help of E-commerce Measurement, the website operator can analyze the purchasing behavior of website visitors to improve its online marketing campaigns. This involves collecting information such as orders placed, average order values, and the time from viewing a product to purchasing it. Google may aggregate this data under a transaction ID that is assigned to the respective user or their device.
_ga: This cookie is used by Google Analytics 4 (GA4) to distinguish users and store a unique client ID (Client Identifier). The client ID is randomly generated and enables interactions to be attributed to a browser across multiple sessions. Google Analytics 4 uses this identifier to analyze website usage and generate statistical reports. The cookie does not contain any directly personally identifiable information.
We use Google Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Tag Manager is a tool that allows us to integrate tracking or analytics tools and other technologies into our website. Google Tag Manager itself does not create user profiles, store cookies, or perform any independent analyses. It is used solely to manage and deploy the tools integrated through it. However, Google Tag Manager records your IP address, which may also be transferred to Google’s parent company in the United States. The use of Google Tag Manager is based on Article 6(1)(f) of the GDPR. The website operator has a legitimate interest in the quick and straightforward integration and management of various tools on its website. If consent has been obtained, processing is carried out exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s device (e.g., device fingerprinting) within the meaning of the TDDDG. Consent may be revoked at any time.
4. Collection, Processing, and Use of Personal Data
Personal data is information related to your identity. This includes information such as your name, address, mailing address, phone number, and email address. We use the information you provide solely to process your inquiry.5. Subscribe to our newsletters
Our website offers users the opportunity to subscribe to our company’s newsletter. By subscribing to the newsletter, you consent to the storage, processing, and use of your personal data (name, address, and email address) by Veranstaltungs- und Kongress GmbH Rosenheim and Positive Group Deutschland GmbH for promotional purposes (electronic distribution) related to the Lokschuppen Exhibition Center. The personal data collected as part of the newsletter registration process will be used exclusively for sending our newsletter. Furthermore, newsletter subscribers may be notified by email if this is necessary for the operation of the newsletter service or for related registration purposes, such as in the event of changes to the newsletter content or modifications to the technical infrastructure. You will receive the newsletter you have subscribed to several times a year. Your data will not be shared with third parties for advertising purposes. However, your data will be stored and processed in the following programs/locations and shared with the following third-party companies for processing:• Server of the Veranstaltungs- und Kongress GmbH / hosted by IT Rosenheim
• MS Office 365-Apps
• Positive Group Deutschland GmbH, Wentzingerstr. 21, 79106 Freiburg i.Br., Deutschland (rapidmail)
In general, a data subject can only receive our company’s newsletter if (1) the data subject has a valid email address and (2) the data subject registers to receive the newsletter. For legal reasons, a confirmation email is sent to the email address provided by a data subject when first registering for the newsletter, using the double-opt-in procedure. This confirmation email serves to verify that the owner of the email address, as the data subject, has authorized receipt of the newsletter. If the link is not confirmed within 14 days, the relevant data will be deleted after this period expires. When you subscribe to the newsletter, we also store the IP address assigned by the Internet service provider (ISP) to the computer system used by the data subject at the time of registration, as well as the date and time of registration. The collection of this data is necessary to be able to trace any (potential) misuse of a data subject’s email address at a later date and therefore serves to provide legal protection for the data controller. The consent to the storage of personal data that the data subject has granted us for the purpose of sending the newsletter may be revoked at any time. A link for revoking consent is included in every newsletter. Furthermore, you may unsubscribe from the newsletter at any time by sending an email to vkr@vkr-rosenheim.de, specifying the registered email address.
6. SSL Encryption
To protect your personal data, we use SSL encryption on our websites. Your data is encrypted during transmission, and all information subject to data protection regulations is stored in encrypted form in a secure database.7. Server Log File
The website provider automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These log files contain the IP address of the device you use to access the website or a service, the type of browser you are using, the webpage you visited previously, your system configuration, and the date and time. Your IP address is stored for a maximum of 7 days when you visit our website for the purpose of detecting and defending against attacks. The IP address may constitute personal data because, under certain circumstances, it is possible to determine the identity of the owner of the Internet connection being used by obtaining information from the respective Internet service provider. We analyze the IP address only in the event of attacks on our internet infrastructure. In this case, we have a legitimate interest within the meaning of Article 6(1)(f) of the GDPR in processing the IP address. This legitimate interest arises from the need to defend against the attack on our internet infrastructure, to determine the origin of the attack in order to take criminal and civil legal action against the responsible person, and to effectively prevent further attacks.8. Anonymized analyses of website visits
When you visit our website, our web servers automatically record the IP address of your Internet service provider, the page you visit on our site, and the date and duration of your visit. This data is analyzed exclusively for statistical purposes. It is not disclosed to third parties, not even in part. The data is used to track visitor preferences and optimize the website accordingly. This data is not analyzed on an individual basis.9. Rights of the Data Subject
If your personal data is being processed, you are a data subject within the meaning of the GDPR. You have the following rights vis-à-vis the controller:Right of Access (Art. 15 GDPR): You have the right to request information regarding whether and what personal data is being processed by VKR. In addition, you are entitled to information about the purposes of processing, the categories of personal data, the recipients of the data, the retention period, and other information in accordance with Art. 15 GDPR.
Right to Withdraw Consent (Art. 7(3) GDPR): You have the right to withdraw your consent to the processing of personal data at any time with future effect. The lawfulness of the processing carried out on the basis of your consent up until the time of withdrawal remains unaffected.
Right to Object (Art. 21 GDPR): You have the right to object at any time to the processing of your personal data, provided that the processing is based on Art. 6(1)(e) or (f) GDPR. If personal data is processed for direct marketing purposes, you may object to this at any time without providing a reason.
Right to Rectification (Art. 16 GDPR): You have the right to request the immediate rectification of inaccurate personal data and the completion of incomplete personal data.
Right to Erasure (Art. 17 GDPR): You have the right to request the erasure of your personal data, provided that the legal requirements for doing so are met. In particular, the right to erasure does not apply if the processing is necessary to comply with a legal obligation or to establish, exercise, or defend legal claims.
Right to Restriction of Processing (Art. 18 GDPR): You have the right to request the restriction of the processing of your personal data, provided that the legal requirements for doing so are met.
Right to Data Portability (Art. 20 GDPR): You have the right to receive the personal data you have provided in a structured, commonly used, and machine-readable format, as well as to transmit this data to another controller, provided that the legal requirements are met.
Right to lodge a complaint with a supervisory authority (Art. 77 GDPR): You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates data protection regulations. The competent supervisory authority for Bavaria, for example, is the Bavarian State Office for Data Protection Supervision (BayLDA). An overview of data protection supervisory authorities in Germany can be found at: https://www.bfdi.bund.de/DE/Service/Anschriften/anschriften_table.html
Contact: Veranstaltungs- und Kongress GmbH Rosenheim, Kufsteiner Str. 4, 83022 Rosenheim, vkr@vkr-rosenheim.de, Tel. 08031-36504. There are no costs other than the transmission costs based on the standard rates.
