Privacy policy

Kur und Bäder GmbH Bad Krozingen

1. General Information and Mandatory Information

The protection of your personal data is an important concern to us. We treat your personal data confidentially and in accordance with statutory data protection regulations and this Privacy Policy.

When you use this website, various personal data are collected. Personal data is data by which you can be personally identified. This Privacy Policy explains what data we collect and what we use it for. It also explains how and for what purpose this happens.

We point out that data transmission over the Internet (e.g. in the case of communication by e-mail) can have security gaps. Complete protection of data against access by third parties is not possible.

Within the framework of providing our website, we use hosting service providers in the European Union (Germany) to ensure the availability, integrity, and security of the data (legal basis: Art. 6 para. 1 lit. f GDPR - legitimate interest in the secure operation of our website).

2. Responsible Body

The responsible body for data processing on this website is:
Kur und Bäder GmbH Bad Krozingen
Herbert-Hellmann-Allee 12
79189 Bad Krozingen
Germany
Phone: +49 (0) 7633 4008-0
E-mail: mail@bad-krozingen.info
Managing Director: Rolf Rubsamen

Data Protection Officer:
Herr RA Martin Behrens
Dr. Stilz Behrens & Partner mbB
Eugen-Martin-Straße 4
79106 Freiburg im Breisgau
Germany
E-mail: kanzlei.freiburg@stilz-partner.de
(or by mail via the address of the responsible body with the addition "attn. Data Protection Officer")

3. Your Rights as a Data Subject (Data Subject Rights)

Within the scope of the applicable statutory provisions (GDPR), you have the following rights regarding your personal data at any time:

  • Right to information (Art. 15 GDPR): You have the right to know whether and what data we store about you.
  • Right to rectification (Art. 16 GDPR): You can demand the correction of incorrect or incomplete data.
  • Right to erasure (Art. 17 GDPR): You have the right to request the erasure of your data, provided that no statutory storage obligations stand in the way.
  • Right to restriction of processing (Art. 18 GDPR): Under certain conditions, you can request the restriction of the processing of your data.
  • Right to data portability (Art. 20 GDPR): You have the right to have data that we process automatically on the basis of your consent or in fulfillment of a contract handed over to you or to a third party in a common, machine-readable format.
  • Right to withdraw consent (Art. 7 para. 3 GDPR): Consents once granted can be withdrawn at any time with effect for the future.
  • Right to object (Art. 21 GDPR): If your data is processed on the basis of legitimate interests (Art. 6 para. 1 lit. f GDPR), you have the right to object to the processing.
  • Right of appeal to the supervisory authority (Art. 77 GDPR): You have the right to complain to a data protection supervisory authority about the processing of your personal data by us. The responsible supervisory authority is:
    Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
    Address: Lautenschlagerstraße 20, 70173 Stuttgart, Germany
    Postal address: Postfach 10 29 32, 70025 Stuttgart, Germany
    Phone: +49 (0) 711 615541-0
    E-mail: poststelle@lfdi.bwl.de
    Website: https://www.baden-wuerttemberg.datenschutz.de

4. Data Collection on Our Website

a) Provision of the Website (Server Log Files)
When calling our website, the provider of the pages automatically collects information that your browser automatically transmits to us. These are:
- Browser type and browser version
- Operating system used
- Referrer URL (the previously visited page)
- Host name of the accessing computer
- Time of the server request
- IP address
This data is not merged with other data sources. Processing is based on Art. 6 para. 1 lit. f GDPR (legitimate interest in the error-free presentation and security of the website).

b) Cookies
Our website uses cookies. These are small text files that are stored on your end device.
- Necessary cookies: These cookies are strictly required for the operation and basic functions of the website. The legal basis is Art. 6 para. 1 lit. f GDPR (legitimate interest in providing our online offer).
- Analysis and marketing cookies: We only use these cookies after your express, active consent, which you can grant via our consent banner. The legal basis is Art. 6 para. 1 lit. a GDPR (consent). You can adjust or withdraw your cookie settings at any time via the link in the cookie settings on our website.

c) Online Shop, Bookings and Payment Processing
When you purchase admission tickets, applications, sports courses, or vouchers in our online shop, we process the data you enter (name, address, e-mail address, payment data) to process the purchase contract and to provide the services (legal basis: Art. 6 para. 1 lit. b GDPR).
The provision of this data is required for the conclusion and processing of the contract. Without this data, we cannot execute the order.
For payment processing in the online shop, we pass on the necessary payment data to the commissioned credit institutions, acquirers, or payment service providers (e.g. for credit card payment, PayPal, Giropay, Sofortüberweisung). The transfer takes place exclusively for the purpose of payment processing and only to the extent necessary (legal basis: Art. 6 para. 1 lit. b GDPR).

d) Newsletter (Brevo)
If you register for our newsletter, we process your e-mail address to send you the newsletter. Sending is carried out via the service provider Brevo (Sendinblue GmbH, Köpenicker Str. 126, 10179 Berlin, Germany / Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France), with whom we have concluded a statutory order processing contract (AVV) in accordance with Art. 28 GDPR. The data protection regulations of Brevo can be found at: https://www.brevo.com/de/legal/privacypolicy/
The legal basis for sending is your active consent (Art. 6 para. 1 lit. a GDPR) in the double opt-in procedure. You can unsubscribe from the newsletter at any time via the unsubscribe link in the newsletter.
*Statistical evaluation:* Our newsletter contains tracking technologies (e.g. web beacons) with which we can statistically evaluate whether and when the e-mails were opened and which links were clicked in order to optimize our information offer. You can object to this evaluation by unsubscribing from the newsletter.

e) Google Tag Manager & Google Analytics
We use the Google Tag Manager to integrate web analysis scripts. The Google Tag Manager itself does not process personal data in principle, but serves to play out other tags (such as Google Analytics). The specifically loaded tags are only played out after your consent.
On the basis of your prior active consent (Art. 6 para. 1 lit. a GDPR), we use Google Analytics, a web analysis service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland).
- Google Analytics collects information about website use using cookies.
- IP anonymization is activated by default on this website. The IP address is shortened before further processing. This is intended to exclude or significantly reduce personal references.
- Data transfers to the USA take place on the basis of the EU-US Data Privacy Framework (DPF), for which an adequacy decision of the EU Commission is available.
You can deactivate tracking at any time via the cookie consent banner on our site.

5. Data Processing During the Issuance and Use of the Digital KONUS Guest Card

As a special service during your stay in Bad Krozingen, we provide you with the digital KONUS guest card. This allows you to use public transport (ÖPNV) free of charge in the KONUS area. The use of this service is voluntary.

a) Purpose and Legal Basis of Processing
The personal data stored in our specialized procedures are processed to provide you with the digital KONUS guest card and to check its validity (e.g. when entering the Vita Classica Spa).
The legal basis for processing is:
- Art. 6 para. 1 lit. b GDPR (fulfillment of a contract or implementation of pre-contractual measures within the framework of your guest stay).
- Art. 6 para. 1 lit. c GDPR (fulfillment of a legal obligation under the local spa tax bylaws of the City of Bad Krozingen).
- Art. 6 para. 1 lit. f GDPR (legitimate interests in IT security, prevention of fraud and abuse, and the assertion or defense of legal claims).

b) Type of Processed Data
For this purpose, the following data is collected and processed:
- Last name and first name
- Length of stay (booking period)
- E-mail address
- Complete address
- Date of birth
- Address of the host
- Barcode and usage data (e.g. scan time and location identifier)

c) Recipients and Transfer of Data
For the operation, billing, and maintenance of the system, we work with external service providers with whom we have concluded order processing contracts (AVV) in accordance with Art. 28 GDPR:
- AVS Allg. Verwaltungs- und Service GmbH (Josephsplatz 8, 95444 Bayreuth, Germany): This service provider provides the system for the digital recording of billing data and is authorized to send e-mails on our behalf to provide the digital KONUS guest card.
- raumobil GmbH (Auer Str. 19, 76227 Karlsruhe, Germany): This service provider processes your data within the framework of the technical provision, maintenance, care, and administration of the digital KONUS guest card.

d) Duration of Data Storage
With the expiration of the validity of the digital KONUS guest card, the processed data is deleted. No further storage takes place unless the data is needed for the assertion, exercise, or defense of legal claims (legal basis: Art. 6 para. 1 lit. f GDPR).

e) Special Notice on the Right to Object (Art. 21 GDPR)
You have the right to object at any time, for reasons arising from your particular situation, to data processing based on Art. 6 para. 1 lit. f GDPR. This includes processing for IT security, fraud prevention, and assertion of claims. If you object, we will no longer process your data unless we can prove compelling legitimate reasons that outweigh your interests, or the processing serves the assertion, exercise, or defense of legal claims.

6. Video Surveillance in the Facilities of Kur und Bäder GmbH (Vita Classica, Kurhaus, Kurpark, aquarado)

To ensure operational safety, protect the property of Kur und Bäder GmbH Bad Krozingen and the guests, enforce the respective house rules, and prevent and investigate criminal offenses (e.g. damage to property, theft), designated areas of our facilities (Vita Classica Spa & Sauna Paradise, Kurhaus, Kurpark, and aquarado leisure pool) are video-monitored. Monitoring of private areas (e.g. changing cubicles, shower rooms, toilets, sauna cabins) does not take place.

a) Legal Basis of Data Processing
Data processing is based on Art. 6 para. 1 lit. f GDPR (legitimate interest). Our legitimate interest consists in securing property, protecting our guests and employees against unlawful acts, and securing evidence in the event of incidents.

b) Recipients of the Data
A transfer of the image data takes place exclusively to law enforcement authorities and courts if this is necessary to investigate criminal offenses or to assert civil law claims.

c) Duration of Storage
The recordings are automatically overwritten or deleted after a period of maximum 72 hours, unless in a specific individual case an incident exists that requires a longer retention for securing evidence (e.g. for transfer to the police).

7. Storage Duration

We only store your personal data as long as is necessary to fulfill the respective purpose or as provided for by statutory storage periods (in particular according to the German Commercial Code [HGB] and the Fiscal Code [AO] with periods of 6 to 10 years).
- Data from contracts and invoices are stored for 10 years in accordance with tax and commercial law storage obligations.
- Data in the context of inquiries or newsletters will be deleted immediately in the event of withdrawal or termination of correspondence, unless statutory storage obligations stand in the way.

8. Automated Decision-Making

Automated decision-making including profiling in accordance with Art. 22 para. 1 and 4 GDPR does not take place on our website.

Kur und Bäder GmbH Bad Krozingen | Stand: July 2026