I. COLLECTION OF DATA WHEN YOU VISIT OUR WEBSITE AND OUR SERVICES
The following information tells you about what personal data we process when you visit our website or contact us via the website.
Definition: Personal data
The term personal data covers all information which refers to an identified or identifiable natural person. An identifiable natural person is one who can be identified directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
This includes, for example, information such as your name, your address, your telephone number, your language, your e-mail address and your date of birth.
Definition: Processing personal data
When processing data, we treat your personal data responsibly and confidentially. You can therefore be sure that we comply with the applicable national regulations (in particular the German Data Protection Act [“BDSG”]) and European data protection regulations (EU General Data Protection Regulation, hereinafter also referred to as “GDPR”) when processing your personal data.
Processing of personal data means any operation or set of operations which is performed in connection with personal data whether or not by automated means. Data processing means in particular the collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of personal data.
1. Collection of personal data when you visit our website
When you use our website solely for information purposes, i.e. if you do not register or otherwise transmit information to us, use a contact form or create an account, we collect only the personal data that your browser transmits to our server. If you wish to view our website, we collect the following data which we require for technical purposes in order to show you our website and to ensure stability and security (lawfulness pursuant to Art. 6, Para. 1, Sentence 1, Point f GDPR):
- IP address
- date and time of the inquiry
- time zone difference to Greenwich Mean Time (GMT)
- subject of the request (specific page)
- access status/HTTP status code
- data quantity transmitted in each case
- website from which the request was submitted
- operating system and its interface
- language and version of the browser software
In addition to collection of the data stated above, cookies are stored on your computer when you use our website. Cookies are small text files which are stored on the hard drive allocated to the browser you use and which are used to transmit information to the party which places the cookie (in this case, Nürburgring). Cookies cannot execute programs or transmit viruses to your computer. They are intended to make our website contents as a whole more user-friendly and effective.
The following informs you about the type and extent of cookies used by this website and how they function:
- transient cookies
- persistent cookies
Transient cookies are deleted automatically when you close your browser. Transient cookies include in particular session cookies. Session cookies save a session ID which allows us to allocate various inquiries submitted by your browser during one session. This allows us to recognise your computer if you visit our website again. Session cookies are deleted when you logout or close your browser.
Persistent cookies are automatically deleted after a specified period of time which may vary from cookie to cookie. You can delete the cookies at any time in the security settings of your browser.
You can configure your browser setting in accordance with your personal preferences, for instance to refuse acceptance of third-party cookies or all cookies. We use the cookie consent manager “Cookie First”, a service provided by Digital Data Solutions B.V. (registered with Kamer von Koophandel/Netherlands, registration number 75762277), which shows the cookies used by our website and which allows you to manage these cookies individually when you access our website. Please note that if you refuse all cookies, you may not be able to use all the functions of this website.
3. Data processing when you contact us via our website
If you contact us by e-mail or by using a contact form, we store the data you have provided (your e-mail address, in some cases also your name and telephone number) in order to answer your questions. We erase the data collected in that connection as soon as it is no longer necessary for us to store it, or if we are obliged by law to continue to store the data, restrict processing of the data.
4. Involvement of third-party providers in our website
If we use third-party providers for individual functions of the products and services we offer or wish to use your data for promotional purposes, we inform you in detail below of the processes concerned. We also state the criteria that have been specified for the duration of storage.
5. Data processing when you subscribe to our newsletter
You can give your consent to subscribe to our newsletter which keeps you informed about current offers which may be of interest to you. For further details, please refer to the declaration of consent.
We use the double opt-in procedure for subscriptions to our newsletter. This means that after you have registered, an e-mail is sent to the e-mail address you have provided asking you to confirm that you wish to receive the newsletter. If you do not confirm your subscription, the information you have provided will be erased after one month. We also store the IP addresses you have provided and the date and time of your subscription and confirmation. The object of this procedure is to obtain proof of your subscription and allow any potential misuse of your personal data to be clarified.
The only mandatory data you have to provide in order to receive our newsletter is your e-mail address. The submission of any other separately indicated data is voluntary and will be used to allow us to address you personally. After you have submitted confirmation, we store your e-mail address for the purpose of sending you the newsletter. Lawfulness is pursuant to Art. 6, Para. 1, Sentence 1, Point a GDPR.
You can revoke your consent to receipt of the newsletter and unsubscribe to the newsletter at any time. You can revoke your consent by clicking on the link provided in each newsletter e-mail, by e-mail or by sending notice to the contact data stated below. Revocation of your consent influences the lawfulness of future processing of your personal data once you have notified us that you revoke your consent.
6. Involvement of third-party providers
Our website uses the services of the following third-party providers; in the case of certain third-party providers (social media plug-ins), your data will be processed within the meaning of data protection laws only if you also use these third-party providers yourself in the course of your visit to our website.
6.1. Use of Google Analytics and Google Tag Manager
6.1.1. Google Analytics
The IP address transmitted from your browser in the course of Google Analytics will not be merged with other data of Google.
You can set your browser software to prevent the storage of cookies; however, please note that in that case, you may not be able to use all the functions of this website to the full extent. You can also prevent Google from collecting the data generated by the cookie about your use of the website (including your IP address) and from processing the data by downloading and installing the browser add-on provided at the following link: http://tools.google.com/dlpage/gaoptout?hl=de
This website uses Google Analytics with the add-on “anonymizeIp()“. This means that IP addresses are abbreviated prior to processing and therefore cannot be used to identify any individual person. If the data collected about you permits allocation to an individual person, it will immediately be excluded and the personal data is erased immediately.
We use Google Analytics to analyse the use of our website and regularly improve it. The statistics we obtain allow us to improve our website and make it more interesting for you as user. Lawfulness for the use of Google Analytics is pursuant to Art. 6, Para. 1, Sentence 1, Point a GDPR.
Terms of service: http://www.google.com/analytics/terms/de.html
This website also uses Google Analytics for cross-device analysis of visitor flows, which is performed via a user ID. You can deactivate the cross-device analysis of your use in your customer account under “My data” “Personal data”. https://myaccount.google.com
You can also deactivate user and event-level data which are linked with cookies, user identification (e.g. user ID) and promotion IDs (e.g. DoubleClick cookies, Android promotion ID, IDFA [Apple identifier for advertisers]).
6.1.2. Google Tag Manager
Google Tag Manager is a solution offered by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”), with which sellers can manage website tags via an interface. The Tag Manager tool itself (i.e. the tool that implements the tags) is a cookie-free domain and does not collect any personal data. The tool is used to trigger other tags which could potentially collect data. Google Tag Manager does not access these data. If a domain or cookie level has been deactivated, this continues to apply to all tracking tags that were implemented with Google Tag Manager. http://www.google.de/tagmanager/use-policy.html
6.2. Use of reCAPTCHA
We use “Google reCAPTCHA” (hereinafter “reCAPTCHA”) on our website. Provider is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”). The purpose of reCAPTCHA is to verify whether data input on our website (e.g. in a contact form) is performed by a human or by an automated program. To do so, reCAPTCHA analyses the behaviour of the visitor to the website on the basis of various criteria. This analysis begins automatically as soon as the visitor enters the website. reCAPTCHA evaluates various items of information for the analysis (e.g. IP address, how long the visitor stays on the website, mouse movements made by the visitor). The data collected during the analysis is forwarded to Google.
All reCAPTCHA analyses run in the background. Visitors to the website are not informed that an analysis takes place.
Lawfulness is pursuant to Art. 6, Para. 1, Sentence 1, Point f GDPR. The website operator has a legitimate interest in protecting its website from abusive automated spying and from SPAM.
https://www.google.com/intl/de/policies/privacy/ and https://www.google.com/recaptcha/intro/android.html.
6.3. Use of social media plug-ins
We currently use the following social media plug-ins:
YouTube, Facebook, Instagram and Twitter.
We have no influence over the collected data and data processing operations, nor do we know the full extent of the data collection, processing purposes or storage periods. We also do not have any information about how or when the plug-in provider erases the collected data.
The plug-in provider stores the data collected about you as a user profile which it uses for advertising purposes, market research and/or designing its website in line with user demand. Such an evaluation (inclusive of users who are not logged in) is performed in particular to present targeted advertising and to inform other users of social media about your activities on our website. You have the right to object to the creation of these user profiles; please note that if you wish to exercise that right, you have to contact the plug-in provider concerned. By using plug-ins, we give you the opportunity to interact with social media and other users, so that we can improve our offer and make it more interesting for you as user. Lawfulness for the use of plug-ins is pursuant to Art. 6, Para. 1, Sentence 1, Point f GDPR.
The data is transmitted irrespective of whether or not you have an account with the plug-in provider and are logged in there. If you are logged in to the plug-in provider, the data collected on our website about you will be directly allocated to your account with the plug-in provider. If you click the activated button and link the site, for example, the plug-in provider also stores this information in your user account and discloses this publicly to your contacts. We recommend that you regularly log out after using social media, in particular before activating the button, as this allows you to avoid allocation to your profile with the plug-in provider.
Further information about the purpose and scope of data collection and processing by the plug-in provider is available in the privacy policies of these plug-in providers which are provided below. You will also find further information there about your rights in that connection and about the setting options to protect your privacy.
6.3.1. Information about YouTube
Our online offer includes YouTube videos which are stored on https://www.YouTube.com and can be played directly from our website. Provider is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”). These videos are all provided in the “privacy-enhanced mode”, which means that no data about you as user are transmitted to YouTube if you do not play the videos. The data stated below will only be transmitted when you play the videos. We have no influence over the transmission of these data.
Further information about the purpose and scope of data collection and processing by the plug-in provider is available in the privacy policies of these plug-in providers which are provided below. You will also find further information there about your rights in that connection and about the setting options to protect your privacy: https://www.google.de/intl/de/policies/privacy
YouTube belongs to Google and also processes your personal data in the USA.
6.3.2. Information about Facebook and Instagram
Information about privacy when you use Facebook and Instagram plug-ins.
Our online offer includes programs and plug-ins provided by the social media “Facebook” and “Instagram”. This refers to the buttons with the Facebook logo or Instagram logo and the information “Share on”. These two social media are operated by the company Meta Platforms Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA (hereinafter “Facebook”). All data processing operations in that connection are not performed by us, but by Facebook. It is not known exactly what data processing operations Facebook performs during and after a user has viewed a fan page. We can accordingly provide only the following information, which is based on the knowledge that is currently available:
Even if you have not logged into Facebook or Instagram, Meta Platforms Inc. stores and uses data about your operating system, browser version, IP address and the place of origin derived from that data.
Even if you are not logged in or not registered as a user, Facebook or Instagram can recognise you from cookies and use the statistical data obtained from your visit to the site to create a profile for you during your next login or when you first register with Facebook.
The legal basis for processing your data is Art. 6, Para.1, S.1, Point a GDPR.
6.3.3. Information about Twitter
We use “Twitter” for the purposes of promoting customer loyalty and advertising. Twitter is a microblogging system for short posts. Provider is Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA.
Twitter “Custom Audiences” and “Conversion Tracking” options provide the opportunity of addressing relevant campaigns directly at users and customers who have viewed the Nürburgring website. Twitter does so by storing anonymised user data with the help of a website tag. To do so, Twitter places a cookie in your browser when you visit our website.
When using these services, Nürburgring complies with Twitter’s policy requirements for conversion tracking and custom audiences https://support.twitter.com/articles/20172376#
Users who wish to deactivate interest-based advertising by Twitter can do so, for instance, by means of an opt-out mechanism for personalised ads determined by Twitter – currently available at: https://support.twitter.com/articles/20171528# . You can find more information on how to change your Twitter privacy settings at https://help.twitter.com/de/safety-and-security
The legal basis for processing your data is Art. 6, Para.1, S.1, Point a GDPR.
Further information on the data protection of the individual social media platforms can be found on the page “Data protection social media“.
7. Involvement of Google Maps
We use the services provided by Google Maps on this website. Provider is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”). This allows us to show you interactive maps directly on the website and facilitates use of the map function.
Further information about the purpose and scope of data collection and processing by Google is available in the privacy policies of the provider. You will also find further information there about your rights in that connection and about the setting options to protect your privacy: http://www.google.de/intl/de/policies/privacy. Google also processes your personal data in the USA.
The legal basis for processing your data is Art. 6, Para.1, S.1, Point f GDPR. Our legitimate interest follows from the purposes of data collection as stated above.
Google Maps belongs to Google and also processes your personal data in the USA.
II. DATA PROCESSING IN CONNECTION WITH DATA COLLECTION AND USE FOR CONTRACT PERFORMANCE
Lawfulness of data processing
We collect personal data which you have submitted voluntarily in the course of your order or when contacting us (e.g. by contact form or e-mail). Mandatory fields are indicated as such, as these data are essential for us to perform the contract or to deal with the matter in which you have contacted us. You cannot submit an order or contact us without completing these fields. The data we collect is evident from the individual input forms.
III. GENERAL INFORMATION
1. Period of storage
The maximum storage period depends on the purpose for which the data are processed. The duration of storage conforms to the period of time for which storage is necessary to fulfil the intended purpose (in case of objection). This does not affect our statutory obligations to store the data. We store personal data which is subject to a statutory storage obligation for the duration of the statutory storage period.
2. Recipients of personal data
We transmit personal data internally to the relevant specialist departments at Nürburgring.
As a general principle, your personal data is not transmitted to third parties. Exceptions to the above apply only to the extent that this is necessary to process the orders agreed with you. This includes in particular the involvement of service providers commissioned by us (“data processors”, such as a service provider for the management of e-mail addresses) or those third parties whose involvement or activities are necessary to perform the contract (e.g. the ticket shop at Eventim.Inhouse when you purchase a ticket). The third parties are permitted to use the transmitted data solely for the purposes stated.
3. Location of data processing
All processing of your personal data by our website takes place either in Germany or in Member States of the European Union. We do not transmit your personal data to countries outside the Member States of the European Union (third countries) or to other international organisations. An exception to the above is transmission of data to third countries (including but not limited to the USA) in connection with the use of social plug-ins by the third-party providers stated.
4. Security / technical and organisational measures
We take all necessary technical and organisational measures in compliance with the provisions of Articles 24, 25 and 32 GDPR to protect your personal data from loss, destruction, access, alteration, unauthorised disclosure and abuse.
In that respect we comply with the statutory requirements in respect of the pseudonymisation and encryption of personal data, confidentiality, integrity, availability and resilience of processing systems and services, the availability of personal data and the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident, and the establishment of a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.
We also comply with the requirements of Article 25 GDPR in respect of the principles of privacy by design and privacy by default.
5. Your rights
You have the right to request information about your personal data free of charge and, subject to satisfaction of the statutory requirements, the right to demand rectification, blockage and erasure of your data, to restriction of processing, data portability and the right to object.
You are also entitled to submit a complaint to the competent supervisory authority.