Privacy policy

You can reach our data protection officer at:

Our server counts visits with the software Umami, without cookies and without storing anything in your browser. The website uses no advertising services and loads no content from third-party servers when you open it. Fonts, images and videos are served from our own server. In your browser it only keeps your ticket selection. The vivenu checkout only loads once you choose “Go to checkout”. This website sets cookies only in the administration area for our staff. Questions to our chatbot Kosmo are answered by an AI from Anthropic; for this they go via our server to Anthropic and are also processed in the USA.

The website runs on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data centre in Nuremberg. Hetzner processes the data on our behalf (Art. 28 GDPR).

When you open the website, your browser has to send its IP address, otherwise the server cannot respond. The server keeps no access logs. Only when a connection fails for technical reasons, for example because it is aborted, the upstream forwarding service (reverse proxy) writes an error message containing your IP address. We do not analyse these messages; they are overwritten automatically once the log file reaches its maximum size. The legal basis is our legitimate interest in running the website securely (Art. 6(1)(f) GDPR).

So that we know which pages are read and where our guests come from, we count page views with the software Umami. For every page view our server passes on to Umami: the address of the page (with added parameters only if they are campaign tags such as utm_source), only the domain of the website you came from if you arrived from another website, your browser’s preferred language, the browser identifier and your IP address. When you open the checkout, complete a purchase or the checkout fails to load, we count that as well. Apart from the page, IP address and browser identifier, only the type of event is sent, no tickets, amounts or names. If you came via a link in our newsletter, its campaign tag is sent as well. The website keeps it only while the page is open and does not store it in your browser.

Umami does not store your IP address. It uses a location database on the same server to determine country, region and city from it, and reads browser, operating system and device type from the browser identifier. From the IP address and browser identifier it forms a check value (hash) that changes every month. This lets us count visitors without recognising you beyond that month. Nothing is stored in or read from your browser for this; there are no cookies and no script from Umami.

Umami runs on our server at Hetzner in Nuremberg (section “Hosting”). The installation is operated on our behalf by our service provider Alexander Manhardt (Art. 28 GDPR). No data goes to other providers. The legal basis is our legitimate interest in shaping our offering according to actual use (Art. 6(1)(f) GDPR). We keep the counting data for 25 months so that we can compare two seasons, and then delete it.

When you select tickets, the website stores your selection (ticket type, quantities, day, entry time and car park tickets) in your browser’s storage (localStorage), so it survives a reload or a later visit. This is technically necessary for the service you requested (§ 25(2) no. 2 TDDDG). It is not used for analysis or tracking and stays in your browser until you choose “Go to checkout”. Seven days after the last change it expires and is deleted on your next visit. After a purchase or when you choose “Clear selection”, it is deleted immediately.

If the checkout redirects you to a payment provider (such as PayPal), the website first stores the reference of the current purchase in your browser’s storage as well, so that it can check after your return whether the purchase is complete and then clear your selection. This entry expires after two hours and is deleted immediately after the check.

Our tickets are sold by vivenu GmbH, Völklinger Straße 33, 40221 Düsseldorf, Germany. Only when you choose “Go to checkout” does the website load the vivenu checkout and open it on top of this page. Your IP address and your ticket selection are then sent to vivenu. The checkout may set its own cookies and load further services for payment. The vivenu privacy policy applies. Without JavaScript a plain link leads to the ticket shop; data is again only transferred to vivenu once you click it.

So that the checkout already contains your selection, our server first sends the ticket type, quantities, day, entry time and car park tickets to vivenu, without your IP address and without any other details about you. To prevent abuse, we count these requests per IP address. The IP address is only stored in the database as a check value (hash) that changes every day, and it is deleted after one day.

When you buy tickets, we process the details of your order to deliver your tickets and to answer questions about your order. These include your name, your email address, the tickets bought and your answers in the order form. The order is held in the vivenu system, where we can see it. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR). We keep records of purchases for as long as commercial and tax law requires.

After a purchase, vivenu automatically notifies our server (webhook). The notification also contains your name, your email address and your answers in the order form. Our server reads none of this. It only stores the identifier of the notification, the type of event and the time, to recognise duplicate notifications and to count purchases.

The ticket shop includes the TikTok pixel. It only loads if you agree to the marketing category in the ticket shop’s cookie notice. TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, Ireland, then learns that you visited the shop or bought a ticket. This tells us whether our advertising on TikTok leads to ticket sales. You can withdraw your consent at any time under “Cookie settings” in the ticket shop. The TikTok privacy policy applies.

This site contains simple links to our profiles on Instagram and Facebook, to our press photos on Google Drive and to route planning on Google Maps and OpenStreetMap, no embedded content. We draw our maps ourselves, they load nothing from third-party servers. Data is only transferred to Meta (Instagram, Facebook), Google or the OpenStreetMap Foundation once you follow a link. Their privacy policies apply there.

If you write to us, we process your details to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR where a visit or contract is concerned, otherwise our legitimate interest in answering (Art. 6(1)(f) GDPR). Our mailbox is operated on our behalf by Webmakers GmbH, Marktstraße 34, 99084 Erfurt, Germany (Art. 28 GDPR). We delete enquiries once they are dealt with, unless statutory retention obligations apply.

There are forms for group bookings, general contact and advertising enquiries. We store what you enter there, together with the type and time of the enquiry, on our server at Hetzner and send it by email to our mailbox (group enquiries to buchung@thueringer-glitzerwelt.de, messages via the contact form to info@thueringer-glitzerwelt.de, advertising enquiries to info@thueringer-glitzerwelt.de). A copy of every enquiry goes to the service provider who looks after our website. A short confirmation without your message text is sent to your email address. The legal basis is Art. 6(1)(b) GDPR where a visit or contract is concerned, otherwise our legitimate interest in answering (Art. 6(1)(f) GDPR).

To prevent abuse, we count submitted forms per IP address. The IP address is only stored in the database as a check value (hash) that changes every day, and it is deleted after one day. We do not store your IP address with the enquiry itself. The forms set no cookies and embed no third-party services.

Enquiries are deleted automatically after twelve months, unless statutory retention obligations apply.

Kosmo is an AI assistant. When you ask it a question, our server sends the question and the conversation so far in this session to Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland. Anthropic generates the answer from it. Before you see the answer, a second request to Anthropic checks the question and the answer. It makes sure the answer is appropriate and suitable for children. Anthropic processes the data on our behalf (Art. 28 GDPR), stores it in the USA and may also process it in other countries. For transfers to the USA and other third countries, Anthropic has committed in its data processing addendum to the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR). According to Anthropic, it deletes questions and answers within 30 days, except where the law requires longer retention. If Anthropic’s automated safety systems classify a conversation as a violation of Anthropic’s usage policy, Anthropic may keep it for up to two years. The legal basis is our legitimate interest in answering questions about your visit (Art. 6(1)(f) GDPR).

We do not store conversations. The conversation is kept only by the open page in your browser until you reload or close it. Kosmo sets no cookies and stores nothing in your browser’s storage. If Kosmo could not answer a question, we store only the text of that question, without your IP address and without any link to your session, to improve Kosmo’s answers. It is deleted automatically after 90 days.

To keep Kosmo from being overloaded, we count questions per IP address and hour. The IP address is only stored in the database as a check value (hash) that changes every day, and it is deleted after one day.

Please do not enter any personal data in the chat.

For our newsletter we process your email address on the basis of your consent (Art. 6(1)(a) GDPR). We keep the list of recipients at rapidmail, a service of Positive Group Deutschland GmbH, Ingeborg-Krummer-Schroth-Straße 18a, 79106 Freiburg im Breisgau. rapidmail sends the newsletter on our behalf (Art. 28 GDPR) and stores the data on servers in Germany.

Sign-ups on this website are first stored unconfirmed by the program listmonk on our server at Hetzner Online GmbH in Nuremberg. We will describe here what happens next before the first email goes out to you.

If you agreed to this when signing up, the newsletter contains a small image and its links lead through a rapidmail server. This lets rapidmail record whether you open an issue and which links you click, linked to your address.

The images in the newsletter are stored on our server. When you open an issue, your email program loads them from there and transmits your IP address. The addresses of the images contain nothing that points to you. The same applies to the server logs as when you visit the website (section “Hosting”).

You can unsubscribe at any time via the link at the end of every newsletter or by email to mail@thueringer-glitzerwelt.de. Withdrawal applies to the future; the lawfulness of the processing up to then remains unaffected.

If you do not confirm the sign-up, you will not receive the newsletter. After you unsubscribe, your address stays on a blocklist at rapidmail so that you receive no further newsletters (Art. 6(1)(f) GDPR). We keep the proof of your consent for as long as we need it to defend against claims.

The website has an administration area for our staff. Only people who sign in there receive cookies: a session cookie that expires after eight hours at most and, during sign-in, a cookie for the second factor that expires after ten minutes. Both are technically necessary for signing in (§ 25(2) no. 2 TDDDG). To prevent password guessing, we count sign-in attempts per account and per IP address. The IP address is only stored as a hashed value that changes every day (Art. 6(1)(f) GDPR).

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time (Art. 7(3)). Please contact us or our data protection officer.

Right to object: Where we process data on the basis of our legitimate interest, you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the Thuringian State Commissioner for Data Protection and Freedom of Information (Thüringer Landesbeauftragter für den Datenschutz und die Informationsfreiheit).

We do not make automated decisions or create profiles within the meaning of Art. 22 GDPR.