Privacy Policy
I. At a Glance – Data Processing on our Website
Dear guests and visitors,
we are pleased that you are visiting our website and hope to welcome you soon “live” as a guest at the Oktoberfest in the tent Ochsenbraterei!
We want you to feel completely comfortable with us – online as well as offline. It is therefore a matter of course for us to handle your data with care.
On this page we would like to inform you comprehensively about the processing of your personal data when you visit our website and inform you about your rights under data protection laws.
Your team of the Ochsenbraterei
II. General Notes and Mandatory Information
- Responsible Party
Responsible for the processing of your data both online and on site is the
Ochsenbraterei Haberl OHG
Englischer Garten 3
80538 München
Telefon: (089) 35 38 73-12
Telefax: (089) 35 38 73-40
E-Mail: info@ochsenbraterei.de
- Data Protection Officer
We have appointed an external data protection officer.
You can reach him
– by e-mail: datenschutz@haberl.de
– by mail: msecure GmbH attn: DSB Haberl Bajuwarenring 21 82041 Oberhaching
III. Description and Scope of Data Processing
A. General and Technically Necessary Processing
- Provision of the Website
Every time you visit our website, our system, i.e. the web server, automatically collects information from the system of your accessing computer or end device.
The following data is collected by us in this context:
– Information about the browser type and the version used
– the operating system of the user’s end device
– Internet service provider of the user
– IP address of the user
– date and time of access
– the user’s previous website from which the user accessed our website (referrer URL)
a) Purpose of the Data Processing
The temporary storage of your IP address by our system is necessary to enable delivery of the website to your device. For this purpose, the user’s IP address must necessarily remain stored for the duration of the session. The storage of the above data in so-called log files is done to ensure the functionality of our website. In addition, this data is used by us to optimize the website and to ensure the security of our information technology systems (e.g. for attack detection).
b) Legal Basis
The legal basis for the temporary storage of this data and the log files is Art. 6 para. 1 lit. f of the European General Data Protection Regulation (GDPR) (legitimate interests of us as a website operator in the secure, trouble-free and legally compliant provision of the website).
c) Duration of Storage
The above-mentioned data will be deleted as soon as they are no longer required to achieve the purpose for which they were collected. In the case of the collection of data for the provision of the website, this is the case when the respective session has ended.
In the case of storage of data in log files, this is the case after 7 days at the latest. Storage beyond this period is possible. In this case, the IP address of the user is deleted or alienated by us, so that an assignment of the accessing client is no longer possible and the data contained no longer have any personal reference.
- Session Cookies
To make it easier for you to use our website, we use so-called “session cookies”. These are small text files that are stored on your hard drive only for the duration of your visit to our website and, depending on the settings of your browser program, are deleted again when you close the browser. These cookies do not retrieve any information stored about you on your hard drive and do not affect your files.
Most browsers are set to accept cookies automatically. However, you can disable the storage of cookies or set your browser to notify you when cookies are sent. Please note that individual functions of our website may be affected if you have disabled the use of cookies.
B. E-Mail and Contact Forms, Applications
- E-Mail and Contact Form
We can be contacted via our contact form and the e-mail addresses provided. In this case, the sender’s personal data (in any case, the e-mail address) transmitted with the request will be stored together with the content of the message.
a) Purpose of the Data Processing.
The processing of this personal data serves us to process the content of the contact.
b) Legal Basis
The legal basis for the processing of this data, which is transmitted in the course of sending an request, is Art. 6 para. 1 lit. f GDPR (legitimate, similar interest of us as the responsible party in communicating with the person transmitting the message).
If the request is intended for the conclusion or fulfillment of a contract (for example, in the case of a reservation request), the legal basis is Art. 6 para. 1 lit. b GDPR (fulfillment of a contract or pre-contractual measures for this).
c) Duration of Storage
The above-mentioned data will be deleted as soon as they are no longer required to achieve the purpose for which they were collected. For personal data sent by e-mail or via the contact form, this is the case when the respective conversation with the user has ended. As a rule, the conversation is ended when it can be inferred from the circumstances that the relevant facts have been conclusively clarified. In the case of the preparation or execution of contracts, longer retention periods may result from legal requirements (for example, tax law).
d) Possibility of Objection
As a user, you have the option to object to data processing at any time with effect for the future. In this case, all personal data stored in the course of contacting us will be deleted immediately, unless there are legal retention periods or other legal reasons to the contrary.
- Handling of Applicant Data
On the subpage https://www.ochsenbraterei.de/ochsenbraterei/jobs, we advertise current vacancies for which you can apply by e-mail. Irrespective of this, you can send us unsolicited applications by e-mail to personal@ochsenbraterei.de at any time.
a) Purpose of the Data Processing
The purpose of processing is to contact you in order to decide whether to initiate an employment relationship.
b) Legal Basis
The legal basis for processing your data is Art. 6 para. 1 lit. b GDPR (pre-contractual measures).
c) Duration of Storage
In the event of a successful application, we will add the transmitted data to our personnel files and store or process them for the duration of the statutory retention obligation. Otherwise, we will process your submitted data exclusively for the purposes of the application process and automatically delete it no later than 6 months after completion of the application process.
C. Online Reservation System
We use the online system of Festzelt OS GmbH, Seitzstr. 23, 80538 Munich, Germany, which processes your data on our behalf, to process your reservations and payments.
a) Purpose of the Date Processing
The purpose of the processing is to provide an online platform for managing reservations, displaying tables and their availability, creating and sending booking confirmations, invoices and vouchers, assisting staff with admission control at the marquee, and creating analyses and statistics.
b) Legal basis
The legal basis for the processing of your data is your consent pursuant to Art. 6 para. 1 lit. a GDPR, which you gave us before using the reservation portal. You can revoke this consent at any time by sending an informal e-mail to info@ochsenbraterei.de with effect for the future. Processing lawfully carried out up to this point remains unaffected by the revocation. Insofar as the use of the portal is aimed at the conclusion or fulfillment of a contract, the legal basis is Art. 6 para. 1 lit. b GDPR (fulfillment of a contract or pre-contractual measures for this).
c) Data Transfer / Third Party Processing
The system is operated in German data centers of Amazon Web Services EMEA SARL (AWS), Luxembourg, as a subcontractor of Festzelt OS GmbH. AWS is obligated to comply with data protection regulations through agreed EU standard contractual clauses. In addition, AWS, as a subsidiary of Amazon Web Services, Inc., 410 Terry Avenue North, Seattle, WA 98109-5210, located in the USA, assures to inform about any case of requests for access to our customer data by US authorities and to fend them off if possible, to the extent permitted by law. Furthermore, your data will be encrypted, with Festzelt OS being responsible for key management. Nevertheless, we would like to point out that according to the current legal situation, there is no level of data protection in the USA that is comparable to the standards of the European Union, and it cannot be ruled out with absolute certainty that access by US authorities or services could occur.
d) Duration of Storage
The data will only be processed for as long as it is necessary for the purposes of the processing. In the event that you revoke your consent, the data will be deleted immediately, unless other legal requirements (in particular tax and fiscal regulations) or other legal grounds make further processing or storage mandatory.
D. Newsletter
For sending our newsletter we use services of the company CleverReach GmbH & Co. KG, Schafjückenweg 2, 26180 Rastede, Germany (“CleverReach”).
For this purpose, we pass on the following personal data to CleverReach: e-mail address.
After registering for the newsletter, you will receive an e-mail from CleverReach. Only after clicking on the link contained therein you will be added to the newsletter distribution list (double opt-in procedure).
CleverReach is the recipient of your personal data and contractually acts as a processor for us, regarding the sending of our newsletter. Without your consent and the transmission of your personal data, we cannot send out a newsletter to you.
a) Purpose of the Data Processing
Sending newsletters enables us to provide you with information directly and regularly. In addition, we analyze your usage behavior in order to optimize our offer.
This means, for example, that we learn whether and when the newsletter was opened by you or whether and when you clicked on a link in the newsletter.
b) Legal Basis
The legal basis for this processing is your consent pursuant to Art. 6 para. 1 lit. a GDPR. You can revoke your consent to the processing of your personal data at any time. In all e-mails, you will find a corresponding link with which you can unsubscribe from our distribution list. In addition, the revocation can be made via the specified contact options. The declaration of revocation does not affect the lawfulness of the processing that has taken place to date.
c) Duration of Processing
Your data will be processed as long as a corresponding consent is available. Apart from that, they will be deleted in case of termination of the contract between us and CleverReach, unless legal requirements or other legal reasons make further storage necessary.
E. Analysis and Marketing Tools
- Google Tag Manager – Management of Tools
We use the Google Tag Manager. Google Tag Manager is an organizational tool that allows us to integrate website tags centrally and efficiently via a user interface.
The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, with whom we have concluded a corresponding data processing agreement.
a) Purpose of the Data Processing
As a website operator, we have an interest in the fast and uncomplicated administration of the various tools on our website.
Google Tag Manager collects data on the website and forwards it to the connected analysis tools. These tools (e.g. Google Analytics) then store and analyze it, if enabled.
The Google Tag Manager is a domain and does not store any data itself. The Tag Manager only collects data on how individual tags are used. However, the Google Tag Manager collects your IP address, which may also be transmitted to Google’s parent company in the United States.
b) Legal Basis
The legal basis of the processing is Art. 6 para. 1 lit. a GDPR (your consent, which you have given us via our Consent Banner). You can find Google’s privacy policy here: https://policies.google.com/privacy?hl=de
Google also processes your data in the USA, among other places. We have concluded an data processing agreement with Google, including the so-called Standard Contractual Clauses (SCC) of the European Commission. Nevertheless, we would like to point out that according to current case law, there is no level of data protection in the USA that is comparable to the standards of the European Union.
c) Duration of Processing
Data is not stored by the Tag Manager itself. You can revoke your consent to use the tool at any time with effect for the future.
- Google Analytics
Insofar as you have given your consent, this website uses Google Analytics 4, a web analytics service provided by Google LLC. The responsible provider for users in the EU/EEA and Switzerland is Google Ireland Limited, Gordon House, 4 Barrow Street, Dublin, D04 E5W5, Ireland (“Google”).
Google Analytics uses cookies that enable an analysis of your use of our websites. The information collected by the cookies about your use of this website is generally transferred to a Google server in the USA and stored there.
With Google Analytics 4, the anonymization of IP addresses is activated. Due to IP anonymization, your IP address will be shortened by Google within Member States of the European Union or in other contracting states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transferred to a Google server in the USA and shortened there. According to Google, the IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.
During your website visit, your user behavior is recorded in the form of “events”. Events can be:
– Page views
– First visit to the website
– Start of session
– Your “click path”, interaction with the website
– Scrolls (whenever a user scrolls to the end of the page (90%)
– clicks on external links
– internal search queries
– interaction with videos
– file downloads
– seen / clicked ads
– language settings
Also it is recorded:
– Your approximate location (region)
– your IP address (in shortened form)
– technical information about your browser and the end devices you use (e.g. language setting, screen resolution)
– your internet service provider
– the referrer URL (via which website/ via which advertising medium you came to this website)
a) Purpose of the Data Processing
On behalf of the operator of this website, Google will use this information for the purpose of evaluating your use of the website on a pseudonymous basis and compiling reports on website activity. The reports provided by Google Analytics are used to analyze the performance of our website and the success of our marketing campaigns.
b) Recipients
Recipients of the data are/could be:
– Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (as processor according to Art. 28 GDPR).
– Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
– Alphabet Inc, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
For more information on the terms of use of Google Analytics and on data protection at Google, please visit https://marketingplatform.google.com/about/analytics/terms/de/ and https://policies.google.com/?hl=de b)
c) Third-country transfer
Insofar as data is processed outside the EU/EEA and there is no level of data protection that corresponds to the European standard, we have concluded a contract with the service provider that includes the EU standard contractual clauses in order to establish an appropriate level of data protection. The parent company of Google Ireland, Google LLC, is based in California, USA. A transfer of data to the USA and access by US authorities to the data stored by Google cannot be ruled out. The USA is currently considered a third country from a data protection perspective. You do not have the same rights there as within the EU/EEA. You may not be entitled to any legal remedies against access by authorities.
d) Duration of Storage
The data sent by us and linked to cookies are automatically deleted after 2 months. Data whose retention period has been reached is automatically deleted once a month.
e) Legal Basis
The legal basis for this data processing is your consent pursuant to Art. 6 para. 1 lit. a GDPR.
d) Possibility of Revocation
You can revoke your consent at any time with effect for the future by accessing the cookie settings and changing your selection there. The lawfulness of the processing carried out on the basis of the consent until the revocation remains unaffected.
You can also prevent the storage of cookies from the outset by setting your browser software accordingly. However, if you configure your browser to reject all cookies, this may result in a restriction of functionalities on this and other websites. You can also prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) to Google and the processing of this data by Google by not giving your consent to the cookie setting or by downloading and installing the browser add-on to disable Google Analytics here.
F. Social Media Platforms
We operate channels on the social media platforms “Instagram” and “Facebook”, which are linked on our websites via corresponding icon graphics. When clicking on these links, you will be redirected to external websites. The provider is Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland (“Meta”, formerly known as “Facebook”).
Information on Meta’s data policy can be viewed at https://de-de.facebook.com/privacy/explanation.
The responsible party has no direct influence on the processing of data by these external providers in the context of the operation of this website; the corresponding processing is the sole responsibility of the respective provider. The provision of the linking of the content is based on the legal basis of Art. 6 para. 1 lit. f GDPR. The legitimate interest of the responsible entity lies in the appealing and informative provision of content to increase the utility value for visitors to our website.
IV. Information on Video Surveillance in the Marquee
Visual surveillance is carried out in and around the marquee by means of optical-electronic devices (video surveillance with live transmission and recording function).
a) Purpose of the Data Processing
The video surveillance serves to protect the life, health and freedom of persons on the premises of the marquee.
b) Legal Basis
The legal basis is Art. 6 para. 1 lit. f GDPR in conjunction with § 4 para. 1 of the German Federal Data Protection Act (BDSG). The legitimate interest of the responsible party is derived from the purposes of the processing, § 4 para. no. 3 BDSG. Due to the increased risk situation during the Oktoberfest, the processing is necessary, appropriate and proportionate to achieve the aforementioned protection goals.
c) Duration of Storage
The collected data (video recordings) are generally deleted after 72 hours, unless other legal grounds exist to the contrary.
V. Your Rights
According to the European General Data Protection Regulation (GDPR), you have the right:
– In accordance with Art. 15 GDPR, to request information about your personal data processed by us. This includes the processing purposes, the categories of personal data, the categories of recipients of the data, the planned storage period, the origin of your data, as well as information about the existence of automated decision-making (profiling);
– pursuant to Art. 16 GDPR, to demand the correction of incorrect or completion of your personal data stored by us;
– pursuant to Art. 17 GDPR, to request the erasure of your personal data stored by us, unless the processing is necessary for the exercise of the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defense of legal claims;
– in accordance with Art. 18 GDPR, to request the restriction of the processing of your personal data if you: dispute the accuracy of the data; the processing is unlawful and you object to the erasure of your data; we no longer need your data, but you need it to enforce legal claims; you have objected to the processing as long as it has not yet been determined whether our legitimate grounds override yours;
– in accordance with Art. 20 GDPR to receive your personal data that you have provided to us in a structured, common and machine-readable format or to request the transfer to another controller;
– in accordance with Art. 7 para. 3 GDPR, to revoke any consent given to us at any time. For this purpose, a corresponding e-mail message to us is sufficient. This has the consequence that we can no longer continue the data processing based on this consent for the future. The legality of the data processing carried out until the revocation remains unaffected by the revocation;
– object to the processing of your personal data in accordance with Art. 21 GDPR. If your objection is directed against direct marketing, we will implement this without delay. If the processing of your data is based on legitimate interest of the controller or a third party and your objection is based on your particular situation, we will comply unless there are legitimate grounds for processing that override your interests or we need your data to enforce legal claims.
– complain to a supervisory authority in accordance with Art. 77 GDPR. If you believe that we have not sufficiently complied with your rights and our obligations under the GDPR, you have the right to lodge a complaint with a data protection authority. The competent authority for us is the Bavarian State Office for Data Protection Supervision (BayLDA) Promenade 18 91522 Ansbach, Germany