Privacy Notice
Privacy Information
We are pleased to have you visit this website. We put a high priority on data protection and security for our customers and users. We abide by data-protection regulations, including the EU General Data Protection Regulation (“GDPR”) and Germany’s Federal Data Protection (Bundesdatenschutzgesetz, “BDSG”) and Telemedia Acts (Telemediengesetz, “TMG”).
This privacy information explains to you the information (including personal data) that is processed by us during your visit and your usage of the online service mentioned above (our “website”).
I. Who Is Responsible for Processing Data?
The controller of the processing of personal data and the service provider within the meaning of the TMG is Bitburger Braugruppe GmbH, Römermauer 3, 54634 Bitburg, Germany; telephone number +49-6561-140, fax number +49-6561-142-289, info@bitburger-braugruppe.de. Whenever “we” or “us” is spoken of in this privacy information, it refers to the company mentioned above.
Our data protection officer can be contacted using the above contact options and at datenschutz@bitburger-braugruppe.de.
II. What Principles Do We Uphold?
We comply with data-protection regulations, so we only ever process your personal data when a legal regulation allows it or when you have given us your consent. This also applies when processing personal data for advertising or marketing purposes.
On this website, we may also collect information that alone cannot be personally linked to you directly. In certain situations – particularly when it is combined with other data – this information can nevertheless be deemed “personal data” for data-protection purposes. Furthermore, we may also collect information on this website that cannot be used as a basis for identifying you directly or indirectly; for example, this is the case with consolidated information about all this website’s users.
III. What Data Do We Process?
You can access our website without having to provide personal data directly (such as your name, mailing address, or e-mail address). However, even in this situation we must collect and store certain information so that we can enable you to access our website. Moreover, we also use certain analytics processes on this website.
1. Log Files:
When you visit this website, our Web server automatically stores the domain name or IP address of the requesting system (usually your internet service provider’s) along with the date, time, and duration of your visit; the pages/URLs that you visit, and information about the applications and devices that you used to view our website.
2. Cookies:
We use what are called cookies to make our online offering as user-friendly as possible. Cookies are small text files that are stored in the Web browser that you use. These files help us to recognize specific preferences that our users have when surfing the internet and to design our website accordingly. Most of the cookies we use are called session cookies. They are automatically deleted after your visit. However, we also use permanent cookies. Their purpose is to improve user guidance. You can set your browser to notify you when cookies are set. Doing this makes the use of cookies transparent for you. You can also configure your browser’s settings to make it reject cookies as a rule. However, this might make you unable to use all the website’s functions in some situations.
We wish to give you the option to make an informed decision for or against using cookies that are not essential for the website’s technical functions. Please be aware that you will receive advertisements that are less targeted and less tailored to your interests if you reject marketing cookies.
We differentiate between cookies that are essential for the website’s technical functions and optional cookies.
We give you the option below to set your preferences regarding the categories “strictly necessary” and “comfort”. This lets you choose privacy settings for visiting our website that match your individual desires as far as possible.
“Strictly Necessary” Category
These cookies are essential for the website to operate and contain settings that safeguard the website’s underlying functions and safety features. They also include insights purely about the number of users on our website and the typeface used on this website. You can find more details on the specific cookies that we use because they are strictly necessary in subsections 2.1 to 2.3.
“Convenience” Category
These cookies allow Vimeo and YouTube videos to be played, collect anonymous data for Google Analytics statistics, and, combined with Google Ads, help to display personalized content matching your surfing patterns. You can find more details on the specific cookies that we use for reasons of convenience in subsections 2.4 to 2.9.
You can adjust your personal settings here.
2.1. etracker Website Analytics:
We use a solution from etracker GmbH (Erste Brunnestrasse 1, 20459 Hamburg, Germany, www.etracker.com) on our website. It collects and stores data for marketing and optimization purposes. This data can be combined with cookies to create user profiles kept under pseudonyms. We will not use data processed via etracker to identify you personally without obtaining your consent separately. We will also not merge this data with other collected personal data that concerns you in order to identify you. You can object to processing of the above data at any time with effect for the future. To do this, please download the “cntcookie” by clicking on the link http://www.etracker.de/privacy?et=V23Jbb. Please do not delete this cookie if you wish for your objection to remain in effect. You can find more information in the etracker data-privacy statement at https://www.etracker.com/en/data-privacy-statement/.
2.2. Google reCaptcha Service:
We use Google’s reCaptcha service to determine whether data on our contact or registration forms was entered by a human or a computer. The provider is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States (“Google”). Google uses the following data to assess whether you are a human or computer: IP address of the device used, the website of ours that you are visiting with the integrated Captcha, the date and duration of the visit, identifier data for the browser and operating-system types used, your Google account if you are logged onto Google, cursor movements in the reCaptcha spaces, and tasks that require you to identify images. You can find more information about data protection with Google reCaptcha at: www.google.com/intl/en/policies/privacy/ and https://www.google.com/recaptcha/intro/android.html.
2.3. Google Web Fonts:
We use Web fonts that are provided by Google (Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States) to display fonts consistently. When you visit our website, your browser loads the required Web fonts into your cache so that it can display text and fonts correctly. For this purpose, the browser that you use must establish a connection with Google’s servers. Google learns that our website is being accessed from your IP address as part of this process. Your computer will use a default typeface if Web fonts are not supported by your browser. You can find further information about data protection with Google Web Fonts at https://developers.google.com/fonts/faq and https://www.google.com/policies/privacy/.
2.4. Website Analytics with Google Analytics:
Furthermore, we also use Google Analytics on our website, a Web analytics service provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States (“Google”), in order to improve our website continuously. Google Analytics uses cookies, which are text files that are stored on your computer to allow an analysis of how you utilize this website. The information generated by the cookie about your usage of this website is usually sent to a Google server in Europe (or another member state of the European Economic Area) to have the IP address made anonymous, making it impossible to match it with you personally. The truncated IP address is only transferred to a Google server in the United States and stored there after it has been made anonymous. Only in exceptional cases is the full IP address sent to a Google server in the United States and truncated there. Google Analytics on this website is used with an extension for recording IP addresses in an anonymous way (called IP masking). Google uses the collected information on our behalf to analyze your use of the website, to compile reports on website activity, and to perform other services associated with website usage for us. The IP address transmitted from your browser to Google Analytics is not merged with any other data from Google. You can prevent cookies from being stored on your device by adjusting your browser’s settings. However, do be aware that you may not be able to use all website functions in full in this case. Furthermore, you can prevent the data that is generated by the cookie in relation to your usage of the website (including your IP address) from being collected and processed by Google by downloading and installing the browser plug-in available over the following link: http://tools.google.com/dlpage/gaoptout?hl=en. An opt-out cookie will then be set, preventing your data from being recorded when you visit this website in the future. You can find more information about data protection with Google Analytics at http://www.google.com/analytics/terms/gb.html and http://www.google.com/intl/en/analytics/privacyoverview.html.
2.5. Website Analytics with Google Ads:
Moreover, we use the Google Ads Conversion service in order to draw attention to our offerings by displaying advertisements on external websites. This lets us determine how successful the individual advertising activities are in relation to the data from advertising campaigns. Our interest is to show you advertising that interests you and to make our website more interesting for you. These advertisements are supplied by Google (Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States) through what are called “ad servers”. They entail the use of ad-server cookies which measure certain parameters, such the number of times our advertisements are displayed and clicked on by users. When you come to our website via a Google advertisement, Google Ads stores a cookie on your device. These cookies generally expire after thirty days and are not intended to identify you personally. The analytics values stored with this cookie usually include the unique cookie ID, the number of advertisement impressions per placement (frequency), the last impression, and opt-out information.
We do not collect or process any personal data in the advertising activities mentioned. We only receive statistical analyses from Google. We can use these analyses to identify which of our advertising activities are particularly effective. We do not receive any further data from the use of advertising material; in particular, we cannot identify users on the basis of this information.
Your browser uses the marketing tools that we employ to establish a direct connection to the Google servers. We have no control over the scope and further use of the data that Google collects by means of this tool, so the following information is provided in line with our knowledge: By using Ads Conversion, Google is informed that you have viewed the corresponding section of our website or have clicked on one of our advertisements. If you are registered with a Google service, Google can match the visit with your account. Even if you are not registered with Google or have not signed in, there is a possibility that the provider will find out and store your IP address.
We use the Google Ads Remarketing application alongside Google Ads Conversion. This application enables our advertisements to be displayed to you during your subsequent internet usage after visiting our website. This takes place by means of cookies stored in your browser which track and analyze your usage patterns when you visit various websites. Consequently, Google can identify your last visit to our website. Google states that the data collected as part of Google Remarketing is not merged with any personal data of yours that may be stored by Google (e.g., due to you having registered for a Google service such as Gmail). Google also states that pseudonyms are used for Remarketing.
You can find further information about data protection with Google Ads at: http://www.google.com/intl/en/policies/privacy and https://services.google.com/sitestats/en.html.
2.6. Usage of Facebook Pixel:
A Facebook pixel operated by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Facebook”) is used within our online offering.
Using the Facebook pixel, Facebook can designate you – a visitor of our online offering – as an audience for the advertising that it displays. Accordingly, we use the Facebook pixel to display the advertisements that we upload only to Facebook users who have demonstrated an interest in our online offering or exhibited particular attributes (e.g., interests in certain topics or products identified based on websites visited) that we transmit to Facebook. Furthermore, we use the Facebook pixel so that we can measure the effectiveness of our Facebook advertisements for statistical and market-research purposes. We do this by seeing if users are redirected to our website after clicking on a Facebook advertisement. You can visit the Facebook help section for special information and details about the Facebook pixel and how it works.
2.7. Usage of YouTube:
We use YouTube as a service provider for embedding videos. YouTube is operated by YouTube LLC, based at 901 Cherry Avenue, San Bruno, CA 94066, United States. YouTube is represented by Google Inc., based at 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States.
We use plug-ins from YouTube, a service provider, on some of our Web pages. When you view pages on our website that feature such a plug-in, a connection to the YouTube servers is made and the plug-in displayed. This process transmits information to the YouTube server about the pages of ours that you visited. If you are also signed into YouTube as a member, YouTube matches this information with your personal account. When you use this plug-in, e.g., by clicking on a video’s start button, this information is also matched with your account. You can prevent this data from being matched by signing out from your YouTube account and other accounts with YouTube LLC and Google Inc. and deleting the relevant cookies from these companies before you use our website.
You can find more information about data processing and advice about data protection by YouTube (Google) at www.google.de/intl/en/policies/privacy.
2.8. Usage of Vimeo:
We use Vimeo as a service provider for embedding videos. Vimeo is operated by Vimeo, LLC, based at 555 West 18th Street, New York, New York 10011, United States.
We use plug-ins from Vimeo, a service provider, on some of our Web pages. When you view pages on our website that feature such a plug-in, a connection to the Vimeo servers is made and the plug-in displayed. This process transmits information to the Vimeo server about the pages of ours that you visited. If you are also signed into Vimeo as a member, Vimeo matches this information with your personal account. When you use this plug-in, e.g., by clicking on a video’s start button, this information is also matched with your account. You can prevent this data from being matched by signing out from your Vimeo account and deleting the relevant cookies from Vimeo before you use our website.
You can find more information about data processing and advice about data protection by Vimeo at https://vimeo.com/privacy.
2.9 Usage of komoot:
We use iframe to integrate hiking routes into our website that were created using the komoot service of komoot GmbH, Friedrich-Wilhelm-Boelcke-Strasse 2, Potsdam, Germany. So that the content from komoot can be integrated, it is necessary for technical reasons for komoot to communicate with the device of the user. As part of this process, the following information regarding the device of the user is transmitted to komoot: IP address, URL of the retrieved site, the latency of the network connection, date, and time. This data is stored – separately from other data that the user may have provided to komoot – for the following purposes: for load balancing, i.e. to distribute access across multiple devices and to be able to offer the fastest load times possible; to ensure the security of the IT systems, e.g., to defend against specific attacks on the komoot system and to recognize attack patterns; and to ensure the proper operation of the IT systems. As part of this, the IP addresses of the user are stored for a period of 14 days. Additionally, komoot uses the following cookies as part of embedding komoot: cookies to store the language of the user. You can find more information about data processing by komoot at www.komoot.de/privacy.
3. Registration/Customer Account:
When you perform the process to become a registered user – especially when you create a customer account – we collect the personal data that is populated on the registration form on our website. We may ask you to re-enter data previously collected during registration (particularly for identification purposes) and collect other personal data when you wish to use certain content on our website or submit an order.
4. Customer Communication:
In order to safeguard communication with our customers and consumers, we process all information that you share with us when contacting us or that we have requested from you (e.g., your name, address, and other contact details); furthermore, we store the reason for which you are contacting us.
5. Company Pages
In addition to our website, we maintain our own profiles on Facebook and Instagram (“company pages”), and our website may contain links to these company pages. In regard to data processing in connection with usage of these company pages, please take note of the separate information provided in section XI of this notice.
IV. For What Purposes and on What Legal Grounds Do We Process Your Data?
- If personal data contained in log files is processed, it is processed to enable you to use our website; the legal grounds for this are provided in TMG § 15(1).
- Data collected through strictly necessary cookies is processed for the purpose of maintaining our website’s operational security on the basis of GDPR Art. 6(1)(f). We have a legitimate interest in ensuring the security of our website and protecting ourselves against automated data entry (attacks).
Data collected through comfort cookies is processed for the purposes of market research and needs-based website design on the basis of your consent in accordance with GDPR Art. 6(1)(a). Please note that you can at any time withdraw consent you have given us with effect for the future by changing your cookie settings using the link that is provided in this notice or is accessible at the bottom of the page. The lawfulness of processing up until this point in time will not be affected by the withdrawal of consent. - When you submit an order on our website or register as a user or for a customer account on our website, we process the data collected in this context to perform contracts we have entered with you, on the basis of GDPR Art. 6(1)(b).
- We may also process data stored in connection with usage of our website or for the purposes of customer and consumer communication in order to fulfill legal obligations that we are subject to; this is done on the basis of GDPR Art. 6(1)(c).
- If necessary, we also process your data beyond the purposes stated above for the purposes of our legitimate interests or third-party interests; this is done on the basis of GDPR Art. 6(1)(f). In particular, our legitimate interests include:
a) exercising legal claims and defense during legal disputes
b) ensuring consumer-friendly communication
c) preventing and investigating crimes
d) controlling and enhancing our business activities, including risk control
V. Are You Required to Provide Data?
The information required for submitting online orders, ensuring consumer-friendly communication, registering as a user, and creating a customer account is marked out as mandatory in the relevant areas on our website (e.g., an online form); we cannot enable you to use the respective function if you do not provide this mandatory information. Your name and e-mail address are required at a minimum in order to ensure consumer-friendly communication.
If we collect additional personal data from you, we tell you at the time it is collected if providing this information is required by law or contract or is necessary in order to enter into a contract. We usually mark out information that is provided voluntarily and is not based on one of the above obligations or is not necessary in order to enter into a contract.
VI. Who Receives Your Data?
When your personal data is processed, it is normally within our company. Only specific departments/organizational units have access to your personal data, depending on the nature of it. In particular, this includes departments charged with providing our digital services (e.g., websites) and our IT support. A role and privilege policy is used to limit access within our company to the positions and scope needed for the relevant purpose of processing.
We may also transfer your personal data to third parties outside our company within the scope permitted by law. In particular, these external recipients may include:
- associated companies within Bitburger Braugruppe to which we transfer personal data for internal administrative purposes
- service providers that are engaged by us to perform services, potentially including ones that may involve processing personal data, based on a separate contract and subcontractors engaged by our service providers with our approval
- private and public entities if we are compelled by legal obligations to transfer your personal data
VII. Is Automated Decision-Making Used?
We generally do not use any automated decision-making (including profiling) within the meaning of GDPR Art. 22 in connection with our website’s operation. If we use such methods in individual cases, we will inform you about them separately to the extent provided by law.
VIII. Is Data Transferred to Countries outside the EU/EEA?
Your personal data is normally processed within the EU or European Economic Area.
The only situations in which information might eventually be transferred to recipients in “third countries” are those in connection with our engagement of service providers to perform Web analytics services. “Third countries” are countries outside the European Union or European Economic Area which cannot immediately be assumed to have a level of data protection comparable to that of the European Union.
If the information transferred also includes personal data, we ensure before any such transfer that the relevant third country or recipient in a third country possesses the required level of adequate data protection. In particular, this can be demonstrated through an “adequacy decision” made by the European Commission, which is a finding regarding the overall adequacy of data protection in a specific third country. Alternatively, we may also transfer data based on “standard EU contract clauses” agreed with a recipient. We are happy to provide further information about suitable and adequate guarantees of adherence to an adequate level of data protection on request; the contact details can be found at the start of this privacy notice.
IX. For How Long Is Your Data Stored?
We generally store your personal data for as long as we have a legitimate interest in storing it and your interests in stopping its storage are not overriding.
We may also continue storing your data without a legitimate interest if the law requires us to do this (e.g., to fulfill retention obligations). We erase your personal data even without any action on your part once possession of this data is no longer necessary for fulfilling the purpose of processing or the storage of it is otherwise unlawful.
In normal situations:
- The log data is erased within seven days if further storage is not necessary for the legally provided purposes, such as uncovering misuse and identifying and fixing technical faults.
- The data processed in connection with an order or with consumer communication is erased no later than when statutory retention periods expire, and
- The data processed in connection with registration as a user or with a customer account is erased after registration ends or the customer account is deleted.
- The personal data that we must store to fulfill retention obligations is stored until the end of the relevant retention obligation. Where we store personal data solely to comply with retention obligations, this data is normally blocked so that it can only be accessed when this is necessary in connection with the purpose of the retention obligation.
X. What Rights Do You Have?
As a data subject, you have the right to:
- access stored personal data that concerns you, GDPR Art. 15
- rectification of incorrect or incomplete data, GDPR Art. 16
- erasure of personal data, GDPR Art. 17
- restriction of processing, GDPR Art. 18
data portability, GDPR Art. 20, and - object to the processing of personal data concerning you, GDPR Art. 21
You may contact us at any time to exercise these rights, e.g., by using one of the contact channels provided at the start of this privacy notice.
If you have questions about the processing of your data, you can also contact our data protection officer.
Moreover, you are entitled to lodge a complaint with the relevant supervisory authority for data protection, GDPR Art. 77.
XI. Can We Change This Privacy Policy?
The internet’s constant development, constantly changing legal conditions, and the emergence of new social-media networks can make it necessary to amend this privacy policy. For this reason, we reserve the right to amend this privacy policy for the future.
XII. What Applies in Relation to Data Processing on Our Company Pages?
You can find us on the social-media platforms Facebook, Instagram, and YouTube. In addition to the respective social-network provider, we also collect and process personal user data on our social-media profiles. By publishing this notice, we seek to inform you about the extent of the personal data that we process on these platforms and for what purposes we do so.
The individual and, if applicable, joint responsibilities for data processing are described over the following few sections in relation to the social-media profiles that we operate.
Data is processed for the following purposes:
- communication with the social-media profile visitor
- processing requests from our social-media profile visitors
- recording statistical information about the reach of our social-media profiles
- performing marketing campaigns, market analyses, sweepstakes, competitions, or similar campaigns or events
It is necessary to process your personal data in order to fulfill these purposes. The legal grounds for processing the data are provided in GDPR Art. 6(1)(f) unless explicitly stated otherwise. Our legitimate interest is in being able to reply to your messages or inquiries and analyzing the reach and usage of our social-media profiles in order to achieve an appropriate design and continuous optimization. If you wish to enter into a contract with us by sending us an inquiry, the legal grounds for this processing are provided in GDPR Art. 6(1)(b). If we intend to process your personal data for a purpose other than the ones listed above, we will inform you accordingly before processing it.
Please be advised that your personal data may be processed outside the European Union when it is processed through our social-media profiles. This can result in risks for users, e.g., because it may make it harder for users to enforce their rights. Further information can be found in the social-media networks’ privacy policies.
We generally store your personal data for as long as we have a legitimate interest in storing it and your interests in stopping its storage are not overriding. We erase your personal data once possession of this data is no longer necessary for fulfilling the purpose of processing or the storage of it is otherwise unlawful.
You can exercise the rights of yours listed in section X of this privacy notice against us at any time if it is possible for us to satisfy them within the limits of the provision of our social-media profiles. Facebook has taken on primary responsibility for the processing of personal data through the “Insights” service that Facebook offers. This concerns the processing of Insights data and the satisfaction of data-subject rights. For this reason, please contact Facebook directly to learn about all the obligations under the GDPR in relation to the processing of Insights data. Although you may exercise your rights against us, we will forward to Facebook any inquiries that we receive from you on this subject.
Facebook:
Our Facebook fan page (“fan page”) is operated by Facebook Ltd., 4 Grand Canal Square, Grand Canal Harbour, D2 Dublin, Ireland (“Facebook”). When you visit our fan page, Facebook processes your personal data in accordance with its data policy, which you can find at https://www.facebook.com/policy.php.
We process the following personal data:
- your Facebook username and comments published on our fan page and in messages that you have sent using our fan page
- your activity on our fan page using the Facebook Insights service, e.g., visits on our website, the extent of interactions, visits and average duration of video playback, information about the countries and cities that our users come from, and statistics about the general relationships of our users
- other information that is necessary for replying to our visitors or clearly identifying our visitors in our systems
Joint Controllers with Facebook
We use the statistical information (visits on our website, the extent of interactions, visits and average duration of video playback, information about the countries and cities that our users come from, and statistics about the gender of our users) about our fan page’s usage that Facebook provides in an anonymous form through the Facebook “Insights” service. It is not possible for us to match information with individual users or access individual user profiles.
For this reason, we and Facebook are deemed “joint controllers” within the meaning of GDPR Art. 26(1) based on a ruling made by the European Court of Justice on June 5, 2018. Consequently, Facebook and we have entered into an arrangement for joint responsibility in order to fulfill GDPR requirements. This arrangement for joint responsibility can be found at https://www.facebook.com/legal/terms/page_controller_addendum. In it, you can find all information that is relevant for you as a data subject, particularly with regard to exercising your rights under privacy law.
Apart from the processing of personal data mentioned in this privacy policy, we do not have any influence over the processing of personal data in connection with your use of the fan page.
Our Instagram page is operated by Facebook Ltd., 4 Grand Canal Square, Grand Canal Harbour, D2 Dublin, Ireland, which is Instagram’s service provider. When you visit our Instagram page, Instagram processes your personal data in accordance with its data policy, which you can find at https://www.facebook.com/help/instagram/519522125107875.
We use the statistical information (visits on our website, the extent of interactions, information about the countries and cities that our users come from, and statistics about the gender of our users) about our Instagram page’s usage that Instagram provides in an anonymous form through the Instagram “Insights” service. It is not possible for us to match information with individual users or access individual user profiles.
We process the following personal data:
- your Instagram username as well as comments on our Instagram page and messages that you send us through our Instagram page
- your activity on our Instagram page using the Instagram Insights service, e.g., visits on our website, the range of posts, information about the countries and cities that our users come from, and statistics about the gender of our users
- other information that is necessary for replying to our visitors or clearly identifying our visitors in our systems
YouTube
When you visit us on YouTube, YouTube’s operator Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, collects and processes personal data as provided in its privacy policy. You can find this privacy policy at https://policies.google.com/privacy?hl=en.
We use the statistical information (visits on our website, the extent of interactions, the average duration of video playback, information about the countries and cities that our users come from, and statistics about the gender of our users) about our YouTube channel’s usage that YouTube provides in an anonymous form through the “Analytics” service. It is not possible for us to match information with individual users or access individual user profiles.
We process the following personal data:
- your YouTube username and comments that have been published on our YouTube channel
- your activity on our YouTube channel using the YouTube Analytics service, e.g., visits on our website, the extent of interactions, the average duration of video playback, information about the countries and cities that our users come from, and statistics about the gender of our users
- other information that is necessary for replying to our visitors or clearly identifying our visitors in our systems
Current as of June 2021