Privacy

General notes

Person responsible for data processing

The controller pursuant to Article 4(7) of the General Data Protection Regulation (GDPR) is Hannover Marketing und Tourismus GmbH; please see our legal notice for more information.

Contract Service Providers

The general operation and maintenance of our websites, email systems, and other IT systems are carried out with the support of (IT) service providers who act on our behalf and may therefore access (or receive) your data to the extent necessary.

Data Protection Officer

Our external data protection officer:

Althammer & Kill GmbH & Co. KG
Roscherstraße 7
30161 Hanover
Email: kontakt-dsb@ak-datenschutz.de

Collection and Use of Your Data

The scope and nature of the collection, as well as the use of your personal data, vary depending on the context in which you interact with us—for example, whether you visit our website to access information, use the services we offer, or contact us.

Below you will find information on data protection for selected key processing contexts. If you have any questions regarding data protection or wish to exercise your rights as listed below, please contact us using the contact information provided in the legal notice or contact our Data Protection Officer.

Your rights

As a data subject, you have the right of access (Art. 15 GDPR), the right to rectification (Art. 16 GDPR), the right to erasure (Art. 17 GDPR), the right to restriction of processing (Art. 18 GDPR), and the right to data portability (Art. 20 GDPR).

If the processing is based on your consent, you have the right to withdraw that consent at any time, without providing a reason, with effect for the future (Art. 7(3) GDPR).

You have the right to object (Art. 21 GDPR): If we process personal data to protect our legitimate interests (Art. 6(1)(f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation.

You have the right to file a complaint with a data protection supervisory authority (Art. 77 of the GDPR).

You may exercise your rights at any time.

Visit the website

Processing for the Purpose of Providing the Website

Purpose of the processing

When you visit this website using your browser, your browser transmits certain data that must be processed by the relevant server in order to deliver the requested content to you. This data includes your IP address, information about the specific page you accessed, the time of the request, the address (URL) of the referring website, and information about the browser and operating system you are using.

In order to detect technical errors on the website or unauthorized use, some of this data is stored on the server in anonymized form as log data. To do this, your IP address is anonymized by replacing part of it with a random value. It is then no longer possible to link the IP address to a specific individual.

Storage duration

To process a browser request, the server that serves this website stores the data only until it is finally transmitted.

As a general rule, IP addresses are stored in anonymized form. Anonymization is achieved by truncating the last four digits of the IP address. These anonymized addresses are stored for a maximum of 366 days. Non-anonymized IP addresses are stored only on a case-by-case basis and temporarily, for as long as required by law.

Legal basis

The legal basis for the processing of your personal data is our legitimate interest in providing a high-performance and secure website, i.e., Article 6(1)(f) of the GDPR. The storage and analysis of log files serve our legitimate interest in detecting and resolving malfunctions and attempted attacks, i.e., Article 6(1)(f) of the GDPR.

Web analysis

Purpose of the processing

On our websites, we use Matomo, a web analytics service that allows us to anonymously analyze your usage behavior on our websites.

Matomo uses cookies that are stored on your computer in your current browser. For this purpose, the usage information generated (including your truncated IP address) is transmitted to our server. Your IP address is immediately anonymized during this process, so that you, as a user, remain anonymous to us. The information generated by a cookie regarding your use of our websites is not shared with third parties. You can prevent the use of cookies by adjusting your browser settings accordingly.

If you do not consent to the storage and analysis of this data, you can opt out at any time by clicking the link below. In this case, a so-called opt-out cookie will be stored in your browser, which means that Matomo will not collect any session data.

Storage duration

Because the data is anonymized immediately, no personal data is stored.

Legal basis

The legal basis for anonymizing data for analytical purposes is our legitimate interest in analyzing and improving the use of our websites, i.e., Article 6(1)(f) of the GDPR.

Google Analytics

Purpose of the processing

We use Google Analytics 4 to analyze your use of the website and to compile reports on website activity. The reports provided by Google Analytics are used to analyze the performance of our website and the success of our marketing campaigns.

Google Analytics stores cookies on your computer that enable the analysis of how our website is used. The data stored includes the user’s IP address, the website visited, the website from which the user accessed our website, the subpages accessed from the visited page, the duration of the visit, and the frequency of visits to our website. The information generated by the cookie is generally transmitted to a Google server in the United States and stored there.

In Google Analytics 4, IP address anonymization is enabled by default. Due to IP anonymization, your IP address is truncated by Google within member states of the European Union or in other signatory states to the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the United States and truncated there. According to Google, the IP address transmitted by your browser as part of Google Analytics is not combined with other Google data, so that a connection to your person can no longer be established, unless you are logged into your Google Account when visiting our website.

Storage duration

The data we send that is linked to cookies is automatically deleted after 14 months. Data that has reached the end of its retention period is automatically deleted once a month.

Legal basis

The legal basis for the processing is your consent, i.e., Article 6(1)(a) of the GDPR.

Revocation

You may revoke your consent at any time, effective for the future, by accessing the Consent Management Tool and changing your selection there. The lawfulness of the processing carried out on the basis of your consent up until the time of revocation remains unaffected.

You can also prevent the storage of cookies from the outset by setting your browser software accordingly. However, if you configure your browser to reject all cookies, this may limit the functionality of this and other websites. You can also prevent Google from collecting the data generated by the cookie and relating to your use of the website (including your IP address) and from processing this data by Google by clicking

• You may choose not to give your consent to the use of cookies, or
• Download and install the browser add-on to disable Google Analytics HERE.

You can find settings and other information regarding the protection of your data at http://www.google.de/intl/de/policies/privacy or https://privacy.google.com/businesses/compliance/?hl=de#!?modal_active=none.

For more information about the Google Analytics Terms of Service and Google's privacy policy, please visit https://marketingplatform.google.com/about/analytics/terms/de/ and https://policies.google.com/?hl=de.

Additional information on the nature and scope of data processing by Google

During your visit to the website, your user behavior is recorded in the form of "events". Events can be

• Page views
• First-time visit to the website
• Start of the session
• Your "click path," interaction with the website
• Scrolls (whenever a user scrolls to the bottom of the page (90%))
• Clicks on external links
• internal search queries
• Interacting with Videos
• File Downloads
• Ads viewed / clicked
• Language setting

Also recorded:

• Your approximate location (region)
• Your IP address (in abbreviated form)
• Technical information about your browser and the devices you use (e.g., language settings, screen resolution)
• Your Internet Service Provider
• the referrer URL (the website or advertising material through which you arrived at this website)

The recipients of the data are/may be

• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (as a data processor)
• Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
• Alphabet Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA

It cannot be ruled out that U.S. authorities may access the data stored by Google.

Transfer to a Third Country

To the extent that data is processed outside the EU/EEA and there is no level of data protection equivalent to European standards, we have entered into EU Standard Contractual Clauses with the service provider to ensure an adequate level of data protection. The parent company of Google Ireland, Google LLC, is headquartered in California, USA. The transfer of data to the United States and access by U.S. authorities to data stored by Google cannot be ruled out.

Privacy Settings / Consent Management Tool

Purpose of the processing

This website uses the "Sourcepoint" consent manager to obtain your consent to store certain cookies on your device and to document this consent in accordance with data protection regulations.

When you visit the website for the first time, a pop-up window will appear. There, you can click the appropriate buttons to consent to or object to specific data processing activities, to the extent that this is technically possible. Scripts that collect user data and require consent to do so will not be executed until consent has been granted.

Your information will be stored so that the pop-up does not have to be displayed again the next time you visit the website and so that your consent is documented.

When you visit our website, a connection is established with our servers to obtain your consent and other statements regarding the use of cookies. Sourcepoint then stores a cookie in your browser so that it can associate the consents you have granted—or their revocation—with your account.

Storage duration

The data collected in this manner will be stored until you request that we delete it, delete the Sourcepoint cookie yourself, or the purpose for storing the data no longer applies. Mandatory legal retention requirements remain unaffected.

Legal basis

Cookie consent technology is used to obtain the legally required consent for the use of cookies. You can configure your browser settings according to your preferences and, for example, refuse to accept third-party cookies or all cookies. Please note, however, that you may not be able to use all features of this website if you do so.

Measurement method ("SZMnG") of INFOnline GmbH

Purpose of the processing

Our website uses the measurement method (“SZMnG”) provided by INFOnline GmbH (https://www.INFOnline.de) to determine statistical metrics regarding the use of our services. The purpose of this usage measurement is to statistically determine—based on a uniform standard procedure—the number of visits to our website, the number of website visitors, and their browsing behavior, thereby obtaining values that are comparable across the market. For all digital offerings that are members of the Informationsgemeinschaft zur Feststellung der Verbreitung von Werbeträgern e.V. (IVW – http://www.ivw.eu) or that participate in the studies conducted by the Arbeitsgemeinschaft Online-Forschung e.V. (AGOF – http://www.agof.de), usage statistics are regularly processed by AGOF and the Arbeitsgemeinschaft Media-Analyse e.V. (agma – http://www.agma-mmc.de) and published using the “Unique User” metric, as well as by the IVW using the “Page Impression” and “Visits” metrics. These reach figures and statistics can be viewed on the respective websites.

Legal basis for processing by INFOnline GmbH

The measurement conducted by INFOnline GmbH using the SZMnG measurement method is based on a legitimate interest. The purpose of processing personal data is to compile statistics and create user categories. The statistics serve to track and document the use of our website. The user categories form the basis for tailoring advertising materials and campaigns to users’ interests. To market this website, it is essential to measure usage in a way that ensures comparability with other market participants. Our legitimate interest stems from the economic value of the insights derived from the statistics and user categories, as well as from the market value of our website—including in direct comparison with third-party websites—which can be determined based on the statistics.

In addition, we have a legitimate interest in making the pseudonymized data available to INFOnline, AGOF and IVW for the purposes of market research (AGOF, agma) and for statistical purposes (INFOnline, IVW). Furthermore, we have a legitimate interest in making the pseudonymized data available to INFOnline for the further development and provision of interest-based advertising material.

Type of data

INFOnline GmbH collects the following data, which is personal data according to the EU GDPR:

• IP address: On the Internet, every device requires a unique address, the so-called IP address, to transmit data. The at least temporary storage of the IP address is technically necessary due to the way the internet works. The IP addresses are shortened by 1 byte before any processing and only processed further in anonymized form. There is no storage or further processing of the unabridged IP addresses.
• A randomly generated client identifier: Range processing uses either a third-party cookie, a first-party cookie, a local storage object or a signature created from various automatically transmitted information from your browser to recognize computer systems. This identifier is unique for a browser as long as the cookie or local storage object is not deleted. Measurement of the data and subsequent assignment to the respective client identifier is therefore also possible if you access other websites that also use the INFOnline GmbH measurement procedure ("SZMnG"). The validity of the cookie is limited to a maximum of 1 year.

Use of the data 

INFOnline GmbH's measurement method, which is used on this website, determines usage data. This is done in order to collect the performance values page impressions, visits and clients and to form further key figures from this (e.g. qualified clients). In addition, the measured data is used as follows:

• A so-called geolocalization, i.e. the assignment of a website call to the location of the call, takes place exclusively on the basis of the anonymized IP address and only up to the geographical level of the federal states / regions. Under no circumstances can the geographical information obtained in this way be used to draw conclusions about the specific location of a user.
• The usage data of a technical client (e.g. a browser on a device) is merged across websites and stored in a database. This information is used for the technical estimation of the socio-information age and gender and transferred to the AGOF service providers for further reach processing. As part of the AGOF study, socio-characteristics are technically estimated on the basis of a random sample, which can be assigned to the following categories: Age, gender, nationality, professional activity, marital status, general household information, household income, place of residence, Internet use, online interests, place of use, user type.

Storage period of the data at INFOnline GmbH

The full IP address is not stored by INFOnline GmbH. The shortened IP address is stored for a maximum of 60 days. The usage data in connection with the unique identifier is stored for a maximum of 6 months.

Forwarding of data by INFOnline GmbH

Neither the IP address nor the truncated IP address is shared. For the purposes of the AGOF study, data containing client identifiers is shared with the following AGOF service providers:

• Kantar Deutschland GmbH (https://www.tns-infratest.com/)
• Ankordata GmbH & Co. KG (http://www.ankordata.de/homepage/)
• Interrogare GmbH (https://www.interrogare.de/)

Opt-out from the SZM measurement

By activating the opt-out function via this link, you are opting out of participation in the SZM measurement. Please note that in order for the opt-out function to take effect, a special cookie must be placed on the computer you are using and stored permanently. This cookie allows us to recognize you as an opt-out user and exclude your website visits from SZM tracking. If you delete this cookie, you will need to reactivate the opt-out function if you wish to opt out of page view tracking.

OpenStreetMap

Purpose of the processing

We incorporate content from OpenStreetMap into our website to make it easier for you to see the locations of regional events.

Legal basis

The legal basis for the processing is your consent, i.e., Article 6(1)(a) of the GDPR.

Revocation

You may revoke your consent at any time, effective for the future, by accessing the Consent Management Tool and changing your selection there. The lawfulness of the processing carried out on the basis of your consent up until the time of revocation remains unaffected.

YouTube

Purpose of the processing

We embed videos from the YouTube platform on our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). The videos are loaded only after you give your consent (two-click solution). When you visit a page with embedded videos, no connection to YouTube is established. Only when you activate the video by clicking the consent button will your browser load the content from Google. In doing so, your IP address, information about your browser and operating system, and the page you visited may be transmitted to Google. Google may also set cookies and collect usage data, such as information regarding playback, interactions, and reach measurement. If you are signed in to your Google account, Google may associate this usage with your account. We have no control over the scope of Google’s data processing and do not receive any personal usage data from YouTube.

Storage duration

We do not store any data generated by the YouTube embedding. The retention period at Google is governed by Google’s own policies. The cookies set by YouTube have varying durations: session cookies expire when you close your browser, while other cookies remain stored for up to several months. Data is stored by Google in accordance with its policies, to the extent permitted by law. For details, please see Google’s Privacy Policy at https://policies.google.com/privacy.

Legal basis

Videos are loaded and cookies are set based on your consent pursuant to Article 6(1)(a) of the GDPR in conjunction with Section 25(1) of the TDDDG.

Data is transferred to Google in the United States based on the European Commission’s adequacy decision regarding the EU-U.S. Data Privacy Framework (Art. 45 of the GDPR). If Google does not comply with this certification, the Standard Contractual Clauses apply (Art. 46(2)(c) of the GDPR).

Revocation

You may revoke your consent at any time, effective for the future, by accessing the Consent Management Tool and changing your selection there. The lawfulness of the processing carried out on the basis of your consent up until the time of revocation remains unaffected.

Services provided by Hannover Marketing and Tourism GmbH

HMTG’s goal is to promote the 21 municipalities in the Hannover region on a supraregional level. In addition, HMTG acts as a tourism service provider and, through its “City Trip” team, offers a full range of services related to stays in the Hannover region, including the sale of experience packages and city tours, room reservations, and tourist information. To this end, HMTG uses the following external service providers for specific services:

Hotel booking platform, experience packages, city tours, online store incl. ticketing

Holidu GmbH
Riesstrasse 24
80992 Munich
Tel: +49 89 120840988
Email: service@holidu.com

Private accommodation

Lohospo GmbH
Am Bischofskreuz 1
D-79114 Freiburg
Email: service@lohospo.de
Website: www.lohospo.de
Phone: +49 761 154331-37
Fax: +49 761 154331-99

Payment via a payment service provider

If you select one of the following payment methods, the payment information you enter will be transmitted to the corresponding payment service provider.

Your data is transferred in accordance with Article 6(1)(b) of the GDPR (processing necessary for the performance of a contract).

Mastercard, Visa:
Datatrans AG
Kreuzbühlstrasse 26
CH-8008 Zurich, Switzerland
Phone: +41 44 256 81 91
Fax: +41 44 256 81 98
Email: info@datatrans.ch

PayPal:
PayPal (Europe) S.à.r.l. et Cie, S.C.A.,
22-24 Boulevard Royal
, L-2449 Luxembourg.

Contact us

Purpose of the processing

When you contact us via the contact form, by email, or by phone, we will store the information you provide (your name, email address, phone number if applicable, and your message) in order to answer your question(s). Required fields are marked separately; additional information is optional.

Storage duration

We delete the data collected in this context once storage is no longer necessary, or we restrict its processing if there are legal retention requirements (up to ten years for the archiving of business email correspondence as required by commercial and tax law).

Legal basis of data processing

The processing is necessary for the performance of a contract to which the data subject is a party or for the implementation of precontractual measures taken at the data subject’s request, i.e., Article 6(1)(b) of the GDPR.

Unless the inquiry is related to pre-contractual or contractual measures, the processing is based on our legitimate interest in responding to the inquiry, i.e., Article 6(1)(f) of the GDPR. 

Note on Communication via Email

Our email systems support encrypted communication using SSL technology (TLS 1.2, including PFS). This means that your emails can generally be transmitted in an encrypted format. Please note, however, that encryption also depends on the configuration of your email program, and we therefore cannot guarantee complete data security during transmission.

For information that requires a high level of confidentiality, we recommend sending it by mail.

Applications

Purpose of the processing

We process the data you have provided to us in connection with your application in order to assess your suitability for the position (or, if applicable, other open positions) and to carry out the application process.

Storage duration

If you have submitted a speculative application to us and we decline your application, we will delete your data immediately.

Applications for advertised positions will be deleted 6 months after a rejection.

If you have consented to the continued storage of your personal data, we will add your information to our applicant pool. The data will be deleted from the pool after 2 years.

If you are offered a position as part of the application process, your data will be transferred to our human resources information system.

Legal basis

The processing of your data as part of the application process is permitted for the purpose of deciding whether to establish an employment relationship; it is therefore based on Article 6(1)(b) of the GDPR in conjunction with Section 26 of the BDSG.

If, after the application process has been completed, the data is necessary for legal proceedings, data processing may be carried out to protect legitimate interests pursuant to Article 6(1)(f) of the GDPR. In such cases, our interest consists in asserting or defending against claims.

Newsletter

Purpose of the processing

In order to receive our newsletter on a regular basis, in addition to your consent under data protection law, we need at least your email address (required) to which the newsletter should be sent. Any additional information is voluntary and will be used to address you personally and to clarify any questions regarding your email address.

For registration, we generally use the so-called double opt-in procedure, which means we will not send you the newsletter until you have confirmed your registration via a confirmation email sent to you for this purpose by clicking the link contained therein. This is to ensure that only you, as the owner of the email address provided, can subscribe to the newsletter.

Storage duration

Once you have successfully registered, your data will be stored for as long as you remain subscribed to the newsletter. After you unsubscribe, we will store the data for statistical purposes only and in an anonymous form.

In addition, we store the IP addresses you use and the times you subscribe to and confirm the newsletter. The purpose of this is to provide the necessary proof of your consent and, if necessary, to investigate any misuse of your personal data (e.g., a third party improperly uses your email address to subscribe).

Legal basis

Subscription to the newsletter is based on your personal consent, i.e., on the basis of Article 6(1)(a) of the GDPR.

We store detailed information regarding the time of your registration and the IP address used in order to fulfill our legitimate interest in complying with our data protection accountability obligations, i.e., Article 6(1)(f) of the GDPR.

Revocation

You can unsubscribe from any newsletter you have subscribed to with us at any time by clicking the corresponding link at the bottom of the newsletter or by sending a message to the contact information provided in the legal notice.

Social Media Presence

We maintain an online presence on the social networks and platforms listed below (e.g., fan pages or employer review sites). These social networks and platforms are operated exclusively by their respective providers, which results in what is known as joint responsibility.

When you visit our social media pages, your user data is collected and provided to us by the service provider. The specific types of data vary from provider to provider but generally include the following information:

Followers: Number of profiles and those on file; information on growth and trends over a defined time frame.

Range: Number of people who see a specific post; number of interactions on a post. From this, you can determine, for example, which content resonates better with the community than others.

Ad Performance: How many people were reached by a post or paid ad and interacted with it?

Demography: Average age of visitors, gender, place of residence, language.

Since our social media channels are operated by the respective social network providers, these providers may make additional use of your personal data in ways over which we have no control. This often involves collecting your IP address, generating statistical analyses, and processing other information stored in the form of cookies. In some cases, your activities may be directly linked to a profile. This data is also frequently used to display interest-based advertising to you both within and outside the platforms. As the operator, we have no influence over the generation or display of this content and can neither disable this feature nor prevent the processing of the data.

We use social media channels to communicate with customers, prospective customers, and users, as well as for advertising and market research purposes. If you contact us through our social media channels, we process the data you provide to us, as well as the data necessary to handle your inquiry. The processing of additional data is based on our legitimate interest in direct communication with users and in optimizing the design of our online presence. To the extent that you have given your consent to the operators of the respective social media platforms (e.g., by checking a box to opt in), processing is based on our legitimate interest. You may revoke your consent at any time with the provider of the respective platform, effective for the future.

We will delete the data we have collected once the purpose for which it was collected has been fulfilled.

The most effective way to exercise your rights as a data subject and submit requests for information is to contact the platform providers directly, as only they have access to your data and can take immediate action. If our assistance is required, we will help you exercise your rights as a data subject as needed. 

Below is a list of the network providers we use. In the event that data is processed outside the EU, we have taken the necessary measures to ensure that the same level of data protection is maintained (typically by entering into the EU Standard Data Protection Clauses). For more information on the terms of use and privacy policies of the respective platforms, as well as a detailed description of further data processing and the available opt-out options, please visit the providers’ websites at:

Facebook (Facebook Inc., 1601 S California Ave, Palo Alto, California 94304, USA): www.facebook.com/policies/cookies/ and www.facebook.com/policy.php/. Opt-out link: www.facebook.com/settings

Instagram (Instagram LLC., 1601 Willow Road, Menlo Park, CA 94025, USA): www.instagram.com/about/legal/privacy/before-january-19-2013/

X (X International Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland): x.com/en/privacy. Opt-out link: help.x.com/en/rules-and-policies/x-cookies

YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland): https://policies.google.com/privacy?hl=en&gl=de. Opt-out link: tools.google.com/dlpage/gaoptout or https://www.google.com/account/about/