Data protection

Data protection declaration for this online offering and further information about the duty to provide information according to Art. 13 GDPR on the collection of personal data from the data subject

Last updated: 2 November 2026
This data protection declaration is based on version GDPR 1.0 of 27.06.2018, produced by Deutsche Datenschutzkanzlei Datenschutz-Office Munich – www.deutsche-datenschutzkanzlei.de. We updated it on 2 November 2026 to reflect the current state of our website (including consent management, YouTube and Google Maps, and the removal of Google Analytics, Google search and the newsletter). In case of doubt, the German version applies.

Data protection
We, the Schwabinger Weihnachtsmarkt e. V, are responsible for this online offering and, as the provider of a teleservice, must inform you at the beginning of your visit to our website, about the type, scope and purpose of the collection and use of personal data in a precise, transparent, understandable and easily accessible way in clear and simple language. The contents of the information must be accessible to you at all times. We are therefore obliged to inform you of which personal data will be collected or used. Any information relating to an identified or identifiable natural person is described as personal data.

We place great value on the security of your data and compliance with the data protection regulations. The collection, processing and use of personal data is subject to the regulations of the European and national laws currently in force

In the following data protection declaration, we would like to show you how we handle your personal data and how you can make contact with us:

Schwabinger Weihnachtsmarkt e.V.
Geschäftsstelle
C/O Atelier – KLEINA
St. Anna Str.14
80538 München

Association register Nr.: VR 7520
Manager: Stephanie Schmitz
Telephone: +49 89
E-Mail: info@schwabingerweihnacht.de

General

For the sake of easier reading, no gender-specific distinction is made in our data protection declaration. The terms used apply, in the context of equal treatment, to both genders.

The meaning of the terminology used, for example ‘personal data’ or its ‘processing’ can be taken from Article 4 of the EU-General Data Protection Regulation (GDPR).

The users’ personal data processed in the context of this online offering, includes inventory data (e.g. customers’ names and addresses), contract data (e.g. services used, name of person responsible, payment information), usage data (e.g. Websites of our online offering visited, interest in our products) and content data (e.g. input into the contact form).

‘User’ includes all categories of persons affected by the data processing. These include, for example, our business partners, customers, interested parties and other visitors to our online offering.

Specific

Data protection declaration
We guarantee that we only collect, process, store and use your incoming data in connection with the processing of your request, as well as for internal purposes and providing the services that you have requested or to make content available.

Basis of data processing
We process the user’s personal data only in compliance with the relevant data protection regulations. The user’s data are only processed when the following statutory permission exists:

  • in order to deliver our contractual performance (e.g. Processing orders) and online services
  • processing is required by law
  • your consent is given
  • on the basis of our legitimate interests (i.e. interest in the analysis, optimization, and economic operation and security of our online offering in the sense of Art. 6 para. 1 lit. f. GDPR, in particular range measurement, production of profiles for advertising and marketing purposes, as well as the collection of access data and the use of services from third party providers)

We would like to show you where the main legal grounds are regulated in the GDPR:

  • Consent Art. 6 para. 1 lit. a. and Art. 7 GDPR
  • Processing to deliver our contractual performance and carrying out contractual measures: Art. 6 para. 1 lit. b. GDPR
  • Processing to safeguard our legitimate interests: Art. 6 para. 1 lit. f. GDPR

Data transfer to third parties
Your data is only transferred to third parties as described in this data protection declaration. In particular, data is transmitted to Google when embedded YouTube videos or Google Maps are loaded – but only after you have given your consent (see “Consent management”, “Use of YouTube” and “Use of Google Maps” below).

Data transfers to third countries or an international organization
Third countries are countries in which the GDPR is not directly applicable law. In principle, this includes all countries outside the EU or the European Economic Area.

If you consent to loading YouTube videos or Google Maps, Google may also transfer your data to the USA and to other third countries. Google LLC (USA) is certified under the EU-US Data Privacy Framework, for which an adequacy decision of the EU Commission exists (Art. 45 GDPR). For transfers to other third countries without an adequacy decision, Google states that it relies on the EU Commission’s standard contractual clauses (Art. 46 GDPR). Further information:

Length of storage of your personal data
We adhere to the principles of data economy and data avoidance. This means the data made available to us is only retained for as long as it is needed to fulfil the previously named purposes or as laid down by the manifold storage periods provided for by the legislator. If the relevant purpose no longer exists, respectively after expiry of the appropriate period, your data is routinely blocked, respectively erased, in accordance with the statutory provisions.

We have developed a company-internal concept to guarantee this procedure

Making contact
If you make contact with us by email, telephone, fax etc., you consent to electronic communication. Personal data will be collected in the context of contacting us. Your data are transmitted with SSL encryption. The information which you provide will be stored exclusively for the purpose of processing your inquiry and for possible follow-up questions.

We would like to tell you the legal grounds:

  • Processing to fulfil our performance and carry out contractual measures: Art. 6 para. 1 lit. b. GDPR
  • Processing to safeguard our legitimate interests: Art. 6 para. 1 lit. f. GDPR

We would like to advise you that emails can be read or changed, unnoticed and without authorization, during transmission. We would also like to bring to your attention that we use software to filter unwanted emails (spam filter). Emails can be rejected by the spam filter if they are wrongly identified as spam due to the presence of certain characteristics

What rights do you have?
a) Right to information
You have the right to obtain information about your stored data without charge. Upon request, we will tell you in writing, in accordance with current law, what personal data we have stored about you. This also includes the origin and recipient of your data as well as the purpose of the data processing.

b) Right to rectification
You have the right to have your data which is stored by us, corrected, if it is incorrect. You can demand a limitation to the processing of your personal data, e.g. if the accuracy of your personal data is contested

c) Right to blocking
Furthermore, you can have your data blocked. So that a blocking of your data can be taken into account at any time, the data must be held in a lock file for control purposes.

d) Right to erasure
You can also demand the erasure of your personal data, so long as no legal storage obligation exists. If such an obligation exists, we will block your data on request. If appropriate statutory requirements are present, we will also erase your personal data without a request from yourself

e) Right to data transferability
You are entitled to demand that the personal data transferred to us, is made available in a format which enables it to be transferred to another location

f) Right to complain to a supervisory authority
You have the option of approaching a data protection supervisory authority with a complaint.

Bavarian State Office for Supervision of Data Protection(BayLDA)
Promenade 27, 91522 Ansbach, Deutschland
Telephone: +49 981 53-1300
Fax: +49 981 53-981300

The Bavarian State Office for Supervision of Data Protection’s complaint form can be accessed over the following link: https://www.lda.bayern.de/de/beschwerde.html

g) Right to object
You have the right to object at any time to the use of your data for internal purposes with future effect. For this, it is sufficient to send an appropriate email to datenschutz@schwabingerweihnacht.de. However, such an objection does not affect the legality of processing procedures which we have already carried out. This does not affect data processing in respect of other legal bases, for example, such as contract initiation (see above).

Protection of your personal data
We take state of the art contractual, organizational and technical security measures to ensure compliance with the provisions of the data protection laws and therefore, to protect the data which we process against accidental or deliberate manipulation, loss, destruction or access by unauthorized persons
In particular, our security measures include the encrypted transfer of data between your browser and our server. 256-bit-SSL (AES 256) encryption technology is used for this.

Thereby your personal data is protected in the context of the following points (extract):
a) Ensuring the confidentiality of your personal data
To ensure the confidentiality of the personal data which we store, we have taken various measures to control access.

b) Ensure the integrity of your personal data
To ensure the integrity of the personal data which we store, we have taken various measures to control transfer and input.

c) Ensure availability of your personal data
To ensure the availability of the personal data which we store, we have taken various measures to control orders and availability.

The security measures employed are continually improved in accordance with technical development. Despite these precautions, because of the insecure nature of the internet, we are unable to guarantee the security of your data transfers to our online offering. For this reason, all data transfers from you to our online offering are made at your own risk.

Protection of minors
Persons who are under 16, are not allowed to provide us with their personal information without the express consent of the person having parental responsibility. These data will be processed in accordance with our data protection declaration.

Server log files
The provider of the pages automatically collects and stores information in so-called server log files, which are automatically transferred to us by your browser. These are:

  • Browser type and browser version
  • operating system used
  • Referrer URL
  • Host name of the accessing computer
  • time of the server request
  • IP address

These data are not combined with other data sources.

The basis for the data processing is Art. 6 para. 1 lit. f. GDPR, which allows data processing to safeguard our legitimate interests

Cookies
We use cookies. Cookies are small text files that are stored locally in the cache of your web browser. Your browser’s local storage (e.g. “Local Storage”) can be used in a similar way. Storing information on, and accessing information from, your device is governed by Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG): we use technically necessary cookies without consent (Section 25 (2) no. 2 TDDDG) and all other cookies only with your consent (Section 25 (1) TDDDG, Art. 6 (1) (a) GDPR).

Our website itself only sets technically necessary cookies:

  • real_cookie_banner… – stores your choice in the consent banner and a random identifier under which your consent is documented. Lifetime: 1 year.
  • wp-wpml_current_language – stores the selected language (German/English). Lifetime: up to 1 day.
  • PHPSESSID – technical session identifier of the server. Lifetime: until the browser is closed.
  • For logged-in editors, WordPress also sets login cookies; these do not affect regular visitors.

Cookies from third parties (YouTube, Google Maps) are only set after you have consented to the respective service.

Control of cookies by the user
You can change or withdraw your consent at any time via the “Change privacy settings” link in the footer of every page. You can also set your browser to accept cookies only on request or to reject them altogether, and delete stored cookies at any time. You will find instructions in your browser’s help, e.g.:

If you reject cookies altogether, some functions of our website may not be fully usable.

Consent management (Real Cookie Banner)
To obtain and document your consent, we use the WordPress plugin “Real Cookie Banner” by devowl.io GmbH, Tannet 12, 94539 Grafling, Germany. The plugin runs on our own server; your data is not transmitted to devowl.io.

On your first visit, we ask which services you consent to. Your decision is stored in a cookie in your browser. As proof of consent (Art. 7 (1) GDPR), we store on our server: a randomly generated identifier (UUID), date and time, the services and service groups selected, the banner settings and texts at the time of consent, technical information (e.g. size of the browser window, page visited) and your IP address in truncated or pseudonymised form. The legal basis is Art. 6 (1) (c) GDPR in conjunction with Art. 7 (1) GDPR (obligation to provide proof). The consent records are deleted once the statutory retention and limitation periods have expired.

Security of our website (Wordfence)
To protect our website against attacks (e.g. automated login attempts, malware), we use the security plugin “Wordfence” by Defiant, Inc., USA. Your IP address, the time and address of the request and browser information are processed on our server and logged in the event of suspicious activity in order to detect and fend off attacks. The legal basis is our legitimate interest in operating the website securely (Art. 6 (1) (f) GDPR). The logs are automatically deleted at regular intervals.

Use of Google Maps
On the “Directions” page we embed a map from Google Maps. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The map is only loaded after you have given your consent – either via the consent banner or via the placeholder shown in place of the map. Before that, no data is transmitted to Google.

After you consent, loading the map transmits in particular your IP address and technical information about your device and browser to Google; Google may set or read cookies and use the data to provide and improve its services and for statistical and advertising purposes. Data may also be transferred to the USA (see “Data transfers to third countries”). The legal basis is your consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG), which you can withdraw at any time with effect for the future via “Change privacy settings” in the footer.

Further information: Google privacy information, Google Privacy Policy.

Use of YouTube
We embed videos from the YouTube platform. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use YouTube’s “privacy-enhanced mode” (youtube-nocookie.com). The videos are only loaded after you have given your consent – either via the consent banner or via the placeholder shown in place of the video. Before that, no data is transmitted to YouTube or Google.

After you consent, loading a video transmits in particular your IP address, the page visited and technical information about your device and browser to YouTube. When a video is played at the latest, YouTube may use cookies and similar technologies (e.g. Local Storage), among other things to collect video statistics, improve user-friendliness and prevent abuse. If you are logged in to YouTube or Google, YouTube may associate the request with your account. Data may also be transferred to the USA and other third countries (see “Data transfers to third countries”). The legal basis is your consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG), which you can withdraw at any time with effect for the future via “Change privacy settings” in the footer.

Further information can be found in the Google Privacy Policy.

Use of RSS Feeds
We use RSS feeds to keep you continuously informed about current topics.
RSS stands for “Really Simple Syndication”. It is an electronic message format. A so-called “RSS reader” is needed to use the feed. Various RSS readers are offered for all operating systems. Some browsers enable RSS feeds to be used without having to install a further program.

Amendments to our data protection policy
We reserve the right to adapt our data protection declaration on occasions, so that it always meets the current legal requirements or to implement changes in our services in the data protection declaration. This could apply e.g. to the introduction of new services. The new data protection declaration would then apply to your return visit.

Brand protection
Each firm or trade mark named here is the property of the respective firm. The naming of brands and names is purely for informative purposes.

C. Specific provisions for Russia

The following applies to users who are residents of the Russian Federation:
The services of our online offer listed above, are not intended for citizens of the Russian Federation who are resident in Russia.
If you are a Russian citizen resident in Russia, you are expressly informed that all personal data that you make available to us over our internet offering, is exclusively at your own risk and on your own responsibility. You further agree that you will not hold us responsible for a possible breach of Russian Federation law.

D. Further information

Alongside this online offering, we also maintain presences in various social media which you can reach by using the appropriate button on our website. If you visit such a presence, it is possible that personal date will be transmitted to the provider of the social network . It is possible that, as well as storing the concrete information that you have input in the social medium, further information will also be processed by the social network provider. Moreover, the social network provider may process the most important data about the computer system from which you are visiting – for example, your IP address, the processor type and browser version used, including plug-ins. If you are logged into your personal user account with the respective network at the time of your visit to such a presence, this contract can attribute the visit to this account. For the purpose and scope of the data collection by the respective medium, as well as the further processing of your data there and your rights in this respect, please consult the respective policies of the respective controllers, E.g. under:
Facebook and Instagram (Meta Platforms Ireland Limited): https://www.facebook.com/privacy/policy/
Google/YouTube: https://policies.google.com/privacy?hl=en
Our website only contains simple links to these networks; data is only transmitted when you click such a link.
We also advise you that our website contains links to external, third-party websites, whereby we have no influence over the processing of data on these external websites.