Privacy Notice for Visitors to the Website

Terms

For the purposes of the following privacy information, the following terms apply, whereby all designations of persons refer to all genders and the associated linguistic forms and are always to be understood with the addition “m/f/d”:

 

1. Controller. The controller responsible for data processing is Spielbank Berlin GmbH & Co. KG, Marlene-Dietrich-Platz 1, 10785 Berlin, T.: +49 (0)30-255 99-0, E: info@spielbank-berlin.de, general partner with power of representation: Spielbank Berlin Verwaltungsgesellschaft mbH, Marlene-Dietrich-Platz 1, 10785 Berlin, itself represented by the management (Marcus Leo Brandenburg, Marcel Langner and Gerhard Wilhelm), Data Protection Officer: STANHOPE Rechtsanwaltsgesellschaft mbH, Attorney-at-Law Dr. Stephan Gärtner, E: request@thenextstanhope.de.
2. Data subjects. Data subjects are all natural persons who visit the controller’s website on which this privacy information is linked.
3. Personal data. This means all information that permits direct or indirect conclusions to be drawn about natural persons, i.e. human beings.
4. Processing of personal data. This means any active or passive handling of personal data, from collection through core processing to deletion.
5. Consent. This means a verifiable declaration of intent by which the data subjects voluntarily and in advance consent to specific data processing.
6. Social media / upload to the Custom Audience. This wording means that the controller uploads the data of the data subjects (usually the email address) to a third-party provider of a social network or medium; naturally only after consent has been given. This enables the controller here to display interest-based advertising (“Ads”) to the data subjects when they visit a social network or medium. This is done as follows: It uploads the contact details (usually the email address) to the respective third-party provider. The third-party provider then checks whether the data subjects are registered with it using these contact details. If not, the contact details are not entered into the Custom Audience (a type of database maintained by the controller with the respective third-party provider). If so, the data are entered into the controller’s Custom Audience. If the data subjects then visit the social network or medium provided by the respective third-party provider, the controller here has the possibility of displaying advertising to the data subjects that is of interest to them.
7. Social media or video embeds / publication of media recordings. This wording means that the controller uploads media recordings of the data subjects (photographs, audio and/or film recordings) to the respective social medium or network or video portal and publishes them there.

 

Information for the Data Subjects

(1) With regard to the data stored concerning them, the data subjects have the following rights: the right of access, the right to rectification of inaccurate data, the right to erasure of data for which there is no longer a reason for retention, the right to restriction of processing and the right to data portability. They also have the right to lodge a complaint with the supervisory authority responsible for the controller.

(2) If the processing is based on consent, the data subjects may withdraw their consent at any time with effect for the future; for example, by an informal notification to one of the contact channels stated above (see Terms / Controller).

(3) If the processing is based on a legitimate interest, namely Article 6(1)(f) GDPR, the data subjects may object to the processing at any time; for example, by an informal notification to one of the contact channels stated above (see Terms / Controller). If the objection is justified, the processing will be terminated. If the legitimate interest lies in direct marketing, the objection is always justified.

(4) No automated decision-making, including profiling, takes place.

(5) A legal obligation to process data exists only insofar as reference is made below to Article 6(1)(c) GDPR.

(6) If data processing is described below, this does not mean that the data subjects have any kind of claim to the associated actions (e.g. media recordings, reviews). The data subject’s claims arise from paragraphs 1 to 3 of this section. The data processing described below only describes possible courses of action, which do not, however, apply to all data subjects.

(7) If personal data are transferred to bodies outside the European Union (third countries), the controller must communicate additional safeguards pursuant to Article 44 et seq. GDPR. If the controller relies on

• Article 45 GDPR, this means that the recipient is located in a country, territory or specified sector for which the EU Commission has decided that it provides an adequate level of data protection.
• Article 46 GDPR in conjunction with EU Standard Contractual Clauses, this means that the recipient has contractually undertaken to comply with the principles of EU data protection law on the basis of a model contract of the EU Commission.
• Article 47 GDPR, this means that the recipient is subject to binding internal data protection rules approved by a supervisory authority based in the EU.
• Article 49(1)(a) GDPR, this means that the data subjects have consented to the transfer to a third country with knowledge of all risks.

 

Expected Standard Data Processing

Informational Use

The data subjects initially use the website for informational purposes, i.e. they access the website without actively interacting with it. In doing so, the controller collects the following data of the data subjects insofar as technically necessary for displaying the website: IP address, date and time of the request, time zone difference from Greenwich Mean Time (GMT), content of the request (specific page), access status/HTTP status code, amount of data transferred in each case, website from which the request originates, browser, operating system and its interface, language and version of the browser software. The purpose is to display the website. The legal basis is Article 6(1)(f) GDPR, whereby the legitimate interest arises from the aforementioned purpose.

 

Changes to Data Processing

If the controller changes the manner in which data are processed, in particular if it uses new recipients, it will inform the data subjects by email of the change; this will be done by transmitting the updated privacy information. The purpose is to fulfil the transparency obligations under the GDPR (Articles 12 to 14 GDPR). The legal basis is Article 6(1)(c) GDPR.

 

Claims, Rights and Conflicts in the Contractual Relationship (GDPR Claims)

If the data subjects exercise their rights under the GDPR, their data are processed as follows:

(1) As a first step, the controller carries out the identification required pursuant to Article 5(1)(a) GDPR in conjunction with Article 12(2), second sentence, GDPR. For this purpose, it compares the data from the request for information (usually name, contact details) with the data held by it.

(2a) If the controller is unable to identify the data subjects, it documents this, communicates this and holds out the prospect of fulfilling the claim as soon as identification has been successful.

(2b) If the controller is able to identify the data subjects, it examines the requirements for the claim – if necessary, obtaining legal advice.

(3a) If the requirements for the claim are met, it fulfils the claim. In the event of a justified

• claim for access, it compiles the data and information required under Article 15 GDPR, transfers them to an access template and provides the information, generally in writing or, if the information was requested by email, by email.
• claim for rectification, it identifies the data to be changed, changes them and informs the data subjects of the change.
• claim for restriction of processing, it identifies the data processing to be restricted, restricts it and informs the data subjects of this.
• claim for erasure, it identifies the data to be erased, erases them and informs the data subjects of this.
• claim to data portability, it identifies the data covered by the claim, transfers them into a structured, commonly used and machine-readable format and makes the data available accordingly.
• objection, it identifies the data processing to which the objection relates, terminates it and informs the data subjects of this.
• withdrawal of consent, it identifies the data processing to which the withdrawal relates, terminates it and informs the data subjects of this.
• complaint procedure, it identifies the data processing to which the complaint relates, remedies the matter and informs the data subjects of this.

(3b) If the requirements for the claim are not met, the controller informs the data subjects of this.

(4) At all stages, the following data are processed: surname, first name, contact details (e.g. address, email address, telephone number), correspondence data, information on the claim being asserted, communication contents, contract data, proof of identity (e.g. identity document data, photograph), other data relevant to the claim in the individual case (e.g. contract number, bank details, payment data, health data), and, where applicable, data relating to legal representation. The processing serves to fulfil the respective legal obligations (Articles 12–21 GDPR). The legal basis is Article 6(1)(c) GDPR.

 

Claims, Rights and Conflicts in the Contractual Relationship (Non-GDPR Claims)

(1) If the data subjects assert their rights under the GDPR or other legal provisions (including contractual claims), the controller processes the data in order to examine and, if applicable, fulfil these claims. The purpose is to examine or respond to the claims, including fulfilling or rejecting the claims. The legal basis is Article 6(1)(f) GDPR, whereby the legitimate interest follows from the nature of the right asserted in each case.

(2) In the event of a legal conflict between the data subjects and the controller, the data are processed in order to make corresponding statements (e.g. asserting claims) and, if necessary, to obtain external legal advice. The following data are processed: name, contact details, all matters connected with the legal conflict. The processing serves the provision of external legal advice/support and the exercise of the controller’s own rights. The legal basis is Article 6(1)(f) GDPR, whereby the legitimate interest follows from the aforementioned purposes.

 

Retention and Deletion

(1) After the end of the visit to the website, all aforementioned data that are still stored are retained. With regard to retention, the purpose and legal basis are derived from the list of retention periods below (paragraph 2).

(2) The following retention periods apply:

• Internal records that are not accounting records (e.g. annual financial statements) must be retained for 10 years, beginning on 31 December of the calendar year in which the respective document was created. The processing serves to fulfil a legal obligation and is based on Article 6(1)(c) GDPR in conjunction with Section 147 AO, Section 257 HGB.
• Accounting records must be retained for 8 years, beginning on 31 December of the calendar year in which the respective document was created. The processing serves to fulfil a legal obligation and is based on Article 6(1)(c) GDPR in conjunction with Section 147 AO, Section 257 HGB.
• Data relating to business communications (e.g. customer letters) and other tax-relevant documents must be retained for 6 years, beginning on 31 December of the calendar year in which the respective document was created. The processing serves to fulfil a legal obligation and is based on Article 6(1)(c) GDPR in conjunction with Section 147 AO, Section 257 HGB.
• Data generated when the data subjects assert data protection claims against the controller are retained for three years, beginning on 31 December of the calendar year in which the controller responds to this. The processing serves to safeguard the interest in defending against claims and is based on Article 6(1)(f) GDPR, whereby the legitimate interest follows from the aforementioned purpose. The duration of the legitimate interest follows from the limitation provisions for claims for damages (Sections 195, 199(1) BGB) and, additionally, from the limitation provisions under the law on administrative offences (Section 31(2) no. 1 OWiG in conjunction with Article 83 GDPR).
• Data generated when the data subjects assert other claims against the controller are retained for three years, beginning on 31 December of the calendar year in which the controller responds to this. The processing serves to safeguard the interest in defending against claims and is based on Article 6(1)(f) GDPR, whereby the legitimate interest follows from the aforementioned purpose. The duration of the legitimate interest follows from the limitation provisions for claims for damages (Sections 195, 199(1) BGB).
• Data based on consent are retained until the consent is withdrawn or until the purpose associated with the processing ceases to apply, whichever occurs earlier. The retention serves the purpose associated with the consent and is based on Article 6(1)(a) GDPR.
• Data proving the granting of consent are retained for 3 years, beginning at the time the consent is withdrawn or the purpose ceases to apply, whichever occurs earlier. The processing serves to safeguard the interest in defending against claims and is based on Article 6(1)(f) GDPR, whereby the legitimate interest follows from the aforementioned purpose. The duration of the legitimate interest follows from the limitation provisions under the law on administrative offences (Section 31(2) no. 1 OWiG in conjunction with Article 83 GDPR).

 

Exceptional Data Processing

External Web Hosting

The controller uses an external web host that displays the website and processes the data technically required for this purpose. The following data are processed: IP address, date and time of the request, time zone difference from Greenwich Mean Time (GMT), content of the request (specific page), access status/HTTP status code, amount of data transferred in each case, website from which the request originates, browser, operating system and its interface, language and version of the browser software. The purpose is to display the website. The legal basis is Article 6(1)(f) GDPR, whereby the legitimate interest follows from the aforementioned purpose.

 

Cookie Consent

The controller gives the data subjects the choice of whether to consent to the use of cookies and uses a cookie consent tool for this purpose. The following data are processed: IP address, date and time of the request, time zone difference from Greenwich Mean Time (GMT), content of the request (specific page), access status/HTTP status code, amount of data transferred in each case, website from which the request originates, browser, operating system and its interface, language and version of the browser software, consent status, date of consent. The purpose is to fulfil a legal obligation. The legal basis is Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR.

 

Form

The controller provides a form tool on the website. Communication takes place between the data subjects and the controller via this tool, whereby the data subjects’ entries are documented and transmitted to the controller. The following data are processed: data concerning the content, manner and scope of the entries in the respective form. The purpose is the initiation and/or performance of contracts. The legal basis is Article 6(1)(b) GDPR.

 

Appointment Booking

If the data subjects wish to arrange a meeting with the controller here, they can view available appointments via an appointment booking portal integrated into this website and simply select one. The controller here then receives a notification from the appointment booking portal. The following data are processed: all data collected when arranging the appointment (usually name, email address, appointment). The purpose is the initiation and/or performance of contracts. The legal basis is Article 6(1)(b) GDPR.

 

Analysis of User Behaviour

Cookies are used to analyse the behaviour of data subjects on this website. These are text files stored on the data subjects’ computer that enable analysis of use of the website. Reports on activities and interactions are generated from the information about user behaviour. The controller here uses these data to regularly improve the user experience on the website. The statistics obtained can also be used to improve its offering in order to direct the data subjects’ interest more specifically towards products and services suitable for them. Further details can be found below in the information on third-party providers. The following data are processed: cookie-based data about interactions (in particular sequence of interactions, duration of stay). Further details can be found below in the information on third-party providers. The purposes are optimisation of this website and improved advertising targeting of the data subjects. The legal basis is Article 6(1)(a) GDPR.

 

Social Media

The controller uses social media and social networks. It has neither any influence on the data collected and data processing operations nor is it fully aware of the scope of data collection, the purposes of processing, the retention periods and the circumstances of deletion of personal data. If the data subjects visit the controller’s company and product pages on social media or advertisements (so-called Ads), there is a possibility that the social media and network providers will store the data collected about them as usage profiles and use these for advertising, market research and/or needs-based design of their websites. Further details can be found below in the information on third-party providers. With regard to responsibility for this data processing, the following applies: insofar as the controller analyses visitor interactions with its company page, both it and the respective third-party provider of the social network or medium are jointly responsible under data protection law; this is in accordance with Article 26 GDPR. In all other cases, the respective third-party provider of the social network or medium is commissioned pursuant to Article 28 GDPR. The following data are processed: cookie- or pixel-based data about interactions with the website and the controller’s company and/or product pages, and, where applicable, email address, name and communication data. Further details can be found below in the information on third-party providers. The purpose is presentation of the controller. The legal basis is Article 6(1)(a) GDPR.

 

Videos

Plugins of a video portal are integrated into the website. Each time a page offering one or more video clips is accessed, a direct connection is established between the data subjects’ browser and a server of the video portal. Further details can be found below in the information on third-party providers. The following data are processed: cookie-based data that transmit the following information: (1) information that the data subjects have visited this website (and, where applicable, the specific subpage), (2) information that a specific video was clicked. Further details can be found below in the information on third-party providers. The purposes are displaying videos, optimisation of this website and improved advertising targeting of the data subjects. The legal basis is Article 6(1)(a) GDPR.

 

External Map

A map is displayed on this website that provides the data subjects with directions. As soon as the data subjects access the corresponding page, the data to be named below are transmitted both to the controller here and to the respective external third-party provider of the map service. The map is displayed only if consent has been given in advance. The following data are processed: (1) data about use of this website, (2) IP address and, where applicable, (2) data about the address entered for route planning. The legal basis is the consent of the data subjects (Article 6(1)(a) GDPR).

 

Recipients

Court:

The recipient category includes courts that, in exercising the controller’s legitimate interests, also receive personal data of the data subjects, for example in legal disputes (e.g. action for damages, …)

 

Public Prosecutors’ Offices/Police:

The recipient category includes public prosecutors’ offices/police that obtain access to certain data on the basis of provisions of criminal procedure law or laws concerning the prevention of danger.

 

Borlabs Cookies:

The WordPress cookie consent plugin “Borlabs Cookie” of Borlabs GmbH (Germany – EU) is used.

 

Microsoft:

Applications of Microsoft Ireland Operations Limited (EU – Ireland) are used, which has been commissioned pursuant to Article 28 GDPR. A transfer of data to a third country that cannot be ruled out (here to Microsoft Corporation, USA) is justified pursuant to Article 45 GDPR. The following applications are used:

Microsoft-365 (Cloud, Software)

Microsoft-Teams (Project Management)

Microsoft-Teams (Video Conference)

 

external law firm:

In dispute and advisory matters, data are transmitted to an external law firm. Insofar as data are processed by the law firm, this does not constitute processing on behalf of a controller (cf. DSK short paper 13), but rather a transfer of data, which is itself justified by Article 6(1)(f) GDPR. This is therefore a case of other outsourcing.

 

external data protection officer:

In data protection advisory matters, data are transmitted to an external data protection officer. Insofar as data are processed by the data protection officer, this does not constitute processing on behalf of a controller (cf. DSK short paper 13), but rather a transfer of data, which is itself justified by Article 6(1)(f) GDPR. This is therefore a case of other outsourcing.

 

PLUTEX:

The web hosting tool “PLUTEX (Webhosting)” of PLUTEX GmbH (Germany) is used, which has been commissioned pursuant to Article 28 GDPR.

 

Google:

Applications of Google Ireland Ltd. (Ireland – EU) are used, which has been commissioned pursuant to Article 28 GDPR. A transfer of data to a third country that cannot be ruled out (here to Google LLC in the USA) is justified pursuant to Article 45 GDPR. The following applications are used:

Google Analytics: Google Analytics helps analyse user behaviour on the website. The IP address is shortened beforehand by the third-party provider within Member States of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a server of the third-party provider in the USA and shortened there. The IP address transmitted by the browser when using this tool is not combined by the third-party provider with other data. The tool is also used for cross-device analysis of visitor traffic, which is carried out using a User ID.

Google Maps: The following should be noted: Google Maps is a map display tool. Which specific data are transmitted in individual cases depends, among other things, on whether the data subjects use this website as logged-in users of a Google account or not.

YouTube (general principle): YouTube is a portal on which videos are shown.

YouTube (own channel): The controller operates its own YouTube channel.

YouTube (media recordings): The controller publishes videos here that show the data subjects.

YouTube (plugin): The controller has integrated a YouTube plugin into the website that, when clicked, leads to YouTube and its channel and otherwise processes the data of the data subjects.

 

Tripadvisor:

The travel and review portal “Tripadvisor”, including its widgets for displaying reviews and company information of Tripadvisor LLC (USA), is used. When the plugin or a link is clicked, the data subjects are taken to the website of Tripadvisor LLC (USA), for which it is independently responsible. Further information can be obtained from Tripadvisor.

 

OpenTable:

The restaurant reservation, table management and guest management system “OpenTable” of OpenTable GmbH (EU – Germany) is used.

 

Spielbank Berlin Verwaltungsgesellschaft mbH:

Spielbank Berlin Verwaltungsgesellschaft mbH (EU – Germany) has been commissioned with the administration of supplier data pursuant to Article 28 GDPR.