Kö-Bogen Fassade
Tourismus NRW e.V., Kö-Bogen Fassade

As at July 2026

Privacy Policy

The following information provides a simple overview of what happens to personal data when you visit this website.

1. Data protection at a glance

General information
The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to identify you personally. For detailed information on data protection, please refer to our privacy policy listed below this text.

Data collection on this website

  • Who is responsible for data collection on this website?
    Data processing on this website is carried out by the website operator. You can find their contact details in the ‘Information on the Data Controller’ section of this privacy policy.
  • How do we collect your data?
    Your data is collected, on the one hand, when you provide it to us. This may include, for example, data that you enter into a contact form. Other data is collected automatically or, with your consent, by our IT systems when you visit the website. This consists primarily of technical data (e.g. internet browser, operating system or time of page view). This data is collected automatically as soon as you access this website.
  • What do we use your data for?
    Some of the data is collected to ensure the website functions correctly. Other data may be used to analyse your user behaviour.
  • What rights do you have regarding your data?
    You have the right at any time to obtain, free of charge, information about the origin, recipients and purpose of your stored personal data. You also have the right to request the rectification or erasure of this data. If you have given your consent to data processing, you may withdraw this consent at any time with effect for the future. You also have the right, under certain circumstances, to request the restriction of the processing of your personal data. Furthermore, you have the right to lodge a complaint with the relevant supervisory authority. You may contact us at any time regarding this or any other questions on the subject of data protection.

Analytics tools and third-party tools
When you visit this website, your browsing behaviour may be analysed for statistical purposes. This is primarily carried out using so-called analytics programmes.
Detailed information on these analytics programmes can be found in the following privacy policy.

2. General information and mandatory details

Data Protection
The operators of this website take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection regulations and this privacy policy. When you use this website, various types of personal data are collected. Personal data is data that can be used to identify you personally. This privacy policy explains what data we collect and how we use it. It also explains how and for what purpose this is done. Please note that data transmission over the internet (e.g. when communicating by email) may be subject to security vulnerabilities. It is not possible to guarantee complete protection of data against access by third parties.

  • Information on the data controller
    The data controllerresponsible for data processing on this website is:
    Tourismus NRW e.V.
    Völklinger Str. 4
    D-40219 Düsseldorf
    Telephone: +49 211 91320-500
    Email: info@nrw-tourismus.de
    The data controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data (e.g. names, email addresses, etc.).
  • Retention period
    Unless a more specific retention period is stated in this privacy policy, your personal data will remain with us until the purpose for which it is processed no longer applies. If you make a valid request for erasure or withdraw your consent to data processing, your data will be erased, provided we have no other legally permissible grounds for retaining your personal data (e.g. retention periods under tax or commercial law); in the latter case, the data will be deleted once these grounds no longer apply.
  • Statutory Data Protection Officer
    We have appointed a Data Protection Officer for our company.
    B&B Penguin Consulting UG
    Data Protection Officer: Florian Bunes
    Am Rötepark 82
    71332 Waiblingen
    Telephone: +49 7151 25 03 523
    Email: florian.bunes@penguincon.de
  • Categories of data recipients
    We use data processors in connection with the processing of your data. The processing operations carried out by such data processors include, for example, hosting, sending emails, maintenance and support of IT systems, customer and order management, order processing, bookkeeping and invoicing, marketing activities, and the destruction of files and data storage media. A data processor is a natural or legal person, public authority, agency or other body that processes personal data on behalf of the data controller. Data processors do not use the data for their own purposes, but carry out data processing exclusively on behalf of the data controller and are contractually obliged to ensure appropriate technical and organisational measures for data protection. In addition, we may transfer your personal data to bodies such as postal and courier services, our principal bank, tax consultancy/audit firms or the tax authorities. For the purposes of contact tracing, data may be transferred to the relevant public health authority. Further recipients may be identified in the following notices.
  • Note on data transfers to third countries
    Our data processing activities may involve the transfer of certain personal data to third countries, i.e. countries where the GDPR is not applicable. Such a transfer is lawful if the European Commission has determined that an adequate level of data protection is provided in that third country. If no such adequacy decision has been issued by the European Commission, the transfer of personal data to a third country will only take place if suitable safeguards are in place in accordance with Article 46 of the GDPR or if one of the conditions set out in Article 49 of the GDPR is met. Unless otherwise stated below, we use the EU Standard Data Protection Clauses as suitable safeguards for the transfer of personal data to third countries. You have the option to receive a copy of these EU Standard Data Protection Clauses or to view them. To do so, please contact us at the address provided under ‘Contact’.

    If you consent to the transfer of personal data to third countries, the transfer will take place on the legal basis of Article 49(1)(a) of the GDPR.
  • Withdrawal of your consent to data processing
    Many data processing operations are only possible with your explicit consent. You may withdraw any consent you have already given at any time. The lawfulness of the data processing carried out prior to the withdrawal remains unaffected by the withdrawal.
  • Right to object to data collection in specific cases and to direct marketing (Article 21 of the GDPR)
    Where data processing is carried out on the basis of Article 6(1)(e) or (f) of the GDPR, you have the right at any time to object to the processing of your personal data on grounds relating to your particular situation; this also applies to an assessment based on these provisions. The relevant legal basis on which processing is based can be found in this Privacy Policy. If you object, we will no longer process your personal data in question, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims (objection under Article 21(1) of the GDPR).
    If your personal data is processed for the purposes of direct marketing, you have the right to object at any time to the processing of your personal data for the purposes of such marketing; this also applies to the examination candidate, insofar as they are associated with such direct marketing. If you object, your personal data will no longer be used for the purposes of direct marketing (objection under Article 21(2) of the GDPR).
  • Right to lodge acomplaint with the competent supervisory authority
    In the event of infringements of the GDPR, data subjects have theright to lodge a complaintwith a supervisoryauthority, in particular in the Member State of their habitual residence, their place of work or the place where the alleged infringement occurred. This right to lodge a complaint is without prejudice to any other administrative or judicial remedies.
  • Right to data portability
    You have the right to have data which we process automatically on the basis of your consent or in fulfilment of a contract provided to you or to a third party in a commonly used, machine-readable format. If you request the direct transfer of the data to another data controller, this will only take place to the extent that it is technically feasible.
  • SSL or TLS encryption
    This website usesSSL or TLS encryption for security reasons and to protect the transmission of confidential content, such as orders or enquiries that you send to us as the website operator. You can recognise an encrypted connection by the fact that the address bar of your browser changes from ‘http://’ to ‘https://’ and by the padlock icon in your browser bar. When SSL or TLS encryption is enabled, the data you send to us cannot be read by third parties.
  • Access, erasure and rectification
    Under the applicable legal provisions, you have the right at any time to obtain, free of charge, information about your stored personal data, its origin and recipients, and the purpose of the data processing, and, where applicable, the right to have this data rectified or erased. You may contact us at any time regarding this matter or with any further questions about personal data.

Right to restriction of processing

You have the right to request that the processing of your personal data be restricted. You may contact us at any time regarding this. The right to restriction of processing applies in the following cases:

  • If you dispute the accuracy of your personal data stored by us, we generally need time to verify this. For the duration of this verification, you have the right to request that the processing of your personal data be restricted.
  • If the processing of your personal data has been or is being carried out unlawfully, you may request the restriction of data processing instead of erasure.
  • If we no longer require your personal data, but you require it to exercise, defend or assert legal claims, you have the right to request the restriction of the processing of your personal data instead of erasure.
  • If you have lodged an objection under Article 21(1) of the GDPR, a balancing of interests between yours and ours must be carried out. Until it has been determined whose interests prevail, you have the right to request the restriction of the processing of your personal data.
  • If you have restricted the processing of your personal data, such data – apart from its storage – may only be processed with your consent or for the purposes of asserting, exercise or defence of legal claims, or to protect the rights of another natural or legal person, or for reasons of an important public interest of the European Union or a Member State.

3. Data collection on this website

Cookies
Our website uses so-called ‘cookies’. Cookies are small text files and do not cause any damage to your device. They are stored on your device either temporarily for the duration of a session (session cookies) or permanently (permanent cookies). Session cookies are automatically deleted at the end of your visit. Permanent cookies remain stored on your device until you delete them yourself or your web browser deletes them automatically.

In some cases, cookies from third-party companies may also be stored on your device when you visit our site (third-party cookies). These enable us or you to use certain services provided by the third-party company (e.g. cookies for processing payment services).
Cookies have various functions. Many cookies are technically necessary, as certain website functions would not work without them (e.g. the shopping basket function or the display of videos). Other cookies are used to analyse user behaviour or to display advertising. Cookies that are required to carry out the electronic communication process (necessary cookies) or to provide specific functions requested by you (functional cookies, e.g. for the shopping basket function) or to optimise the website (e.g. cookies for measuring website traffic) are stored on the basis of Article 6(1)(f) of the GDPR, unless another legal basis is specified. The website operator has a legitimate interest in storing cookies to ensure the technically fault-free and optimised provision of its services. Where consent to the storage of cookies has been requested, the relevant cookies are stored exclusively on the basis of this consent (Section 25(1) of the German Telemedia Act (TDDDG) and Article 6(1)(a) of the GDPR); consent may be withdrawn at any time.

You can configure your browser so that you are notified when cookies are set and can choose to allow cookies only on a case-by-case basis, to block the acceptance of cookies in specific cases or generally, and to enable the automatic deletion of cookies when you close your browser. If you disable cookies, the functionality of this website may be restricted. Where cookies are used by third parties or for analytical purposes, we will inform you of this separately within this privacy policy and, where necessary, seek your consent.

Cookie Information


List

  • Consent via ConsentManager
    Our website uses ConsentManager’s consent technology to obtain your consent to the storage of certain cookies on your device or to the use of certain technologies, and to document this in accordance with data protection regulations. This technology is provided by Jaohawi AB, Håltegelvägen 1b, 72348 Västerås, Sweden, website: https://www.consentmanager.de (hereinafter “ConsentManager”).

    When you visit our website, a connection is established with ConsentManager’s servers to obtain your consents and other declarations regarding the use of cookies. ConsentManager then stores a cookie in your browser so that it can associate the consents you have given – or their withdrawal – with your session. The data collected in this way is stored until you request its deletion, delete the ConsentManager provider cookie yourself, or the purpose for storing the data no longer applies. Mandatory statutory retention obligations remain unaffected. ConsentManager is used to obtain the legally required consents for the use of cookies. The legal basis for this is Article 6(1)(c) of the GDPR.

    Data processing on behalf of a controller: We have entered into a data processing agreement with the aforementioned provider. This is a contract required under data protection law, which ensures that the provider processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.
  • Contact form
    If you send us enquiries via the contact form, the details you provide in the enquiry form – including the contact details you enter there – will be stored by us for the purpose of processing your enquiry and in the event of any follow-up questions. We will not pass on this data without your consent. The processing of this data is based on Article 6(1)(b) of the GDPR, provided that your enquiry relates to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective handling of enquiries addressed to us (Article 6(1)(f) of the GDPR) or on your consent (Article 6(1)(a) of the GDPR), provided that this has been requested.

    The data you enter in the contact form will remain with us until you request its deletion, withdraw your consent to its storage, or the purpose for storing the data no longer applies (e.g. once your enquiry has been dealt with). Mandatory legal provisions – in particular retention periods – remain unaffected.
  • Enquiries by email, telephone or fax
    If you contact us by email,telephone orfax, your enquiry – including any personal data it contains (name, enquiry) – will be stored and processed by us for the purpose of dealing with your request. We will not pass on this data without your consent.
    The processing of this data is based on Article 6(1)(b) of the GDPR, provided that your enquiry relates to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective handling of enquiries addressed to us (Article 6(1)(f) of the GDPR) or on your consent (Article 6(1)(a) of the GDPR), provided that this has been requested.

    The data you send to us via contact enquiries will remain with us until you request its deletion, withdraw your consent to its storage, or the purpose for storing the data no longer applies (e.g. once your enquiry has been dealt with). Mandatory legal provisions – in particular statutory retention periods – remain unaffected.


4. Analytics tools and advertising

  • Google Tag Manager
    We use Google Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

    Google Tag Manager is a tool that enables us to integrate tracking or analytics tools and other technologies into our website. Google Tag Manager itself does not create user profiles, store cookies or carry out any independent analysis. It serves solely to manage and deploy the tools integrated via it. However, Google Tag Manager does record your IP address, which may also be transferred to Google’s parent company in the United States.

    The use of Google Tag Manager is based on Article 6(1)(f) of the GDPR. The website operator has a legitimate interest in the quick and straightforward integration and management of various tools on its website. Where consent has been sought, processing takes place exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent may be withdrawn at any time.

  • Google Analytics
    This website uses features of the web analytics service Google Analytics. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

    Google Analytics enables the website operator to analyse the behaviour of website visitors. In doing so, the website operator receives various usage data, such as page views, time spent on the site, operating systems used and the user’s origin. This data is associated with the user’s respective device. No association is made with a user ID.

    Furthermore, Google Analytics enables us, amongst other things, to record your mouse and scroll movements and clicks. Google Analytics also uses various modelling approaches to supplement the collected data sets and employs machine learning technologies in its data analysis.

    Google Analytics uses technologies that enable the user to be recognised for the purpose of analysing user behaviour (e.g. cookies or device fingerprinting). The information collected by Google regarding the use of this website is generally transmitted to a Google server in the USA and stored there. The use of this service is based on your consent in accordance with Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG. You may withdraw your consent at any time. Data transfer to the USA is based on the EU Commission’s Standard Contractual Clauses. Further details can be found here: https://privacy.google.com/businesses/controllerterms/mccs/.

  • IP anonymisation
    We have enabled the IP anonymisation feature on this website. This means that your IP address is truncated by Google within Member States of the European Union or in other signatory states to the Agreement on the European Economic Area before being transmitted to the USA. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated there. On behalf of the operator of this website, Google will use this information to analyse your use of the website, to compile reports on website activity and to provide the website operator with other services relating to website and internet usage. The IP address transmitted by your browser as part of Google Analytics is not merged with other data held by Google.

  • Browser plug-in

    You can prevent Google from collecting and processing your data by downloading and installing the browser plug-in available via the following link: https://tools.google.com/dlpage/gaoptout?hl=de. Further information on how Google Analytics handles user data can be found in Google’s privacy policy: https://support.google.com/analytics/answer/6004245?hl=de.

  • Demographic features in Google Analytics
    This website uses the ‘demographic features’ function of GoogleAnalytics to display relevant adverts to website visitors within the Google advertising network. This enables reports to be generated that contain information on the age, gender and interests of site visitors. This data is derived from Google’s interest-based advertising and from visitor data provided by third parties. This data cannot be linked to any specific individual. You can disable this feature at any time via the ad settings in your Google Account, or generally prevent Google Analytics from collecting your data as described in the section ‘Objection to data collection’.
  • Data processing on behalf of Google
    We have entered into a data processing agreement with Google and fully comply with the strict requirements of the German data protection authorities when using Google Analytics.
  • Google Ads
    The website operator uses Google Ads. Google Ads is an online advertising programme provided by Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

    Google Ads enables us to display adverts in the Google search engine or on third-party websites when users enter specific search terms into Google (keyword targeting). Furthermore, targeted adverts can be displayed based on user data held by Google (e.g. location data and interests) (audience targeting). As the website operator, we can analyse this data quantitatively, for example by examining which search terms led to our adverts being displayed and how many adverts resulted in clicks.

    Use of this service is based on your consent in accordance with Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG. You may withdraw your consent at any time.

    Data transfers to the USA are based on the EU Commission’s Standard Contractual Clauses. Further details can be found here: https://policies.google.com/privacy/frameworks and https://privacy.google.com/businesses/controllerterms/mccs/.

5. Newsletter

  • Newsletter details
    If you wish to subscribe to the newsletter offered on the website, we require your email address and information that enables us to verify that you are the owner of the email address provided and that you consent to receiving the newsletter. No further data is collected, or only on a voluntary basis. We use this data exclusively for sending the requested information and do not pass it on to third parties.
    The processing of data entered into the newsletter subscription form is carried out solely on the basis of your consent (Article 6(1)(a) of the GDPR). You may withdraw your consent to the storage of your data and email address, and to their use for sending the newsletter, at any time, for example via the ‘Unsubscribe’ link in the newsletter. The lawfulness of any data processing operations that have already taken place remains unaffected by this withdrawal.

    The data you have provided to us for the purpose of subscribing to the newsletter will be stored by us or the newsletter service provider until you unsubscribe from the newsletter, and will be deleted from the newsletter distribution list once you have unsubscribed or once the purpose for which it was collected no longer applies. We reserve the right to delete or block email addresses from our newsletter distribution list at our own discretion, in accordance with our legitimate interest under Article 6(1)(f) of the GDPR.
    After you unsubscribe from the newsletter distribution list, your email address may be stored on our end or by the newsletter service provider on a blacklist, if necessary, to prevent future mailings. The data from the blacklist is used solely for this purpose and is not combined with any other data.
    This serves both your interests and our interest in complying with legal requirements when sending newsletters (legitimate interest within the meaning of Article 6(1)(f) of the GDPR). There is no time limit on storage on the blacklist. You may object to this storage provided that your interests override our legitimate interest.

  • 3pc e-publisher:mail
    This website uses the e-publisher.mail tool provided by 3pc GmbH Neue Kommunikation, Prinzessinnenstraße 1, 10969 Berlin, to send newsletters. The data you provide to subscribe to the newsletter (e.g. your email address) is stored on the servers of e-publisher:mail. The web hosting provider is Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen. The newsletters are sent via Sendinblue GmbH (Brevo), Köpenicker Straße 126, 10179 Berlin.

    The newsletters we send out enable us to analyse the behaviour of newsletter recipients. Among other things, this allows us to analyse how many recipients opened the newsletter and how often each link in the newsletter was clicked. Using what is known as conversion tracking, we can also analyse whether a predefined action (e.g. the purchase of a product on this website) took place after a link in the newsletter was clicked. Further information on data analysis by 3pc e-publisher:mail is available at: https://mail.e-publisher.de/features/

    Data processing is carried out on the basis of your consent (Article 6(1)(a) of the GDPR). You may withdraw this consent at any time by unsubscribing from the newsletter. The lawfulness of any data processing operations that have already taken place remains unaffected by this withdrawal. If you do not wish to have your data analysed by e-publisher:mail, you must unsubscribe from the newsletter. We provide a link for this purpose in every newsletter message.

    The data you have provided to us for the purpose of receiving the newsletter will be stored by us or the newsletter service provider until you unsubscribe from the newsletter, and will be deleted from the newsletter distribution list once you have unsubscribed. Data stored by us for other purposes remains unaffected by this.

    After you unsubscribe from the newsletter mailing list, your email address may be stored on a blacklist by us or the newsletter service provider to prevent future mailings. The data on the blacklist is used solely for this purpose and is not combined with any other data. This serves both your interests and our interest in complying with legal requirements when sending newsletters (legitimate interest within the meaning of Article 6(1)(f) of the GDPR). There is no time limit on storage on the blacklist. You may object to this storage provided that your interests override our legitimate interest.

    For further details, please refer to the privacy policy of e-publisher:mail at:https://3pc.de/datenschutz/

6. Plugins and tools

  • YouTube with enhanced privacy settings
    This website embeds YouTube videos. The operator of the site is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

    We use YouTube in enhanced privacy mode. According to YouTube, this mode ensures that YouTube does not store any information about visitors to this website before they watch the video. However, the enhanced privacy mode does not necessarily prevent data from being shared with YouTube partners. YouTube therefore establishes a connection to the Google DoubleClick network, regardless of whether you watch a video.

    As soon as you play a YouTube video on this website, a connection is established with YouTube’s servers. In doing so, the YouTube server is informed which of our pages you have visited.

    If you are logged into your YouTube account, you allow YouTube to link your browsing behaviour directly to your personal profile. You can prevent this by logging out of your YouTube account.
    Furthermore, once a video has started playing, YouTube may store various cookies on your device or use similar recognition technologies (e.g. device fingerprinting). In this way, YouTube can obtain information about visitors to this website. This information is used, amongst other things, to collect video statistics, improve user-friendliness and prevent fraud. Where applicable, further data processing operations may be triggered after a YouTube video has been played, over which we have no control. The use of YouTube is in the interests of presenting our online services in an appealing manner. This constitutes a legitimate interest within the meaning of Article 6(1)(f) of the GDPR. Where consent has been sought, processing is carried out exclusively on the basis of Article 6(1)(a) of the GDPR; consent may be withdrawn at any time.

    Further information on data protection at YouTube can be found in their privacy policy at: https://policies.google.com/privacy?hl=de
  • Google reCAPTCHA
    We use ‘Google reCAPTCHA’ (hereinafter ‘reCAPTCHA’) on this website. The provider is Google Ireland Limited (‘Google’), Gordon House, Barrow Street, Dublin 4, Ireland. reCAPTCHA is designed to verify whether data entry on this website (e.g. in a contact form) is carried out by a human or by an automated programme. To this end, reCAPTCHA analyses the behaviour of the website visitor based on various characteristics. This analysis begins automatically as soon as the website visitor accesses the website. For the purposes of the analysis, reCAPTCHA evaluates various pieces of information (e.g. IP address, the length of time the website visitor spends on the website, or the mouse movements made by the user). The data collected during the analysis is forwarded to Google. The reCAPTCHA analyses run entirely in the background. Website visitors are not notified that an analysis is taking place. The storage and analysis of the data are carried out on the basis of Article 6(1)(f) of the GDPR. The website operator has a legitimate interest in protecting its web services from malicious automated surveillance and from spam. Where consent has been sought, processing takes place exclusively on the basis of Article 6(1)(a) of the GDPR; consent may be withdrawn at any time.
    For further information on Google reCAPTCHA, please refer to Google’s Privacy Policy and Terms of Service via the following links: https://policies.google.com/privacy?hl=de and https://policies.google.com/terms?hl=de
  • Use of MapToolKit
    We use the MapToolKit mapping service to generate directions and display maps on our website. MapToolKit is provided by Toursprung GmbH, Mariahilfer Str. 93/20, 1060 Vienna, Austria. When you access the content on our website, you are connected to the servers of Toursprung GmbH. In doing so, your IP address and possibly browser data such as your user agent are transmitted. This data is processed exclusively for the purposes mentioned above and to maintain the security and functionality of MapToolKit. The IP address is technically anonymised before any further processing takes place. It is not possible to trace this data back to individual persons.

    The data mentioned is stored only for the duration of use. Further information can be found in the privacy policy at https://www.maptoolkit.com/de/privacy/.

  • NRWow!
    Experience PlannerThe NRWow! Experience Planner is an interactive, AI-based tool for personalised travel and experience planning in North Rhine-Westphalia, which allows you to select places, activities and time periods, receive suggestions and maintain a personal wish list. NRWow! is a widget provided by infomax websolutions GmbH, Aichfeld 2, 83224 Grassau (technical operator).

    Purpose and legal basis
    The widget is used to provide an interactive experience/travel planner (e.g. wish list and planning functions). Processing is carried out on the basis of Article 6(1)(f) of the GDPR (legitimate interest) in the technically secure delivery and use of the expressly selected wish list or plan continuation. No further purposes (e.g. analytics, convenience or personalisation) are pursued.

    Nature and scope of processing

    • Usage/connection data: Your IP address is processed automatically when you access the site; short-term, purpose-limited logging may take place for fault analysis and to defend against attacks.
    • Device storage: To enable the wishlist/plan continuation feature, the widget sets a local identifier (an anonymous identifier in LocalStorage) exclusively for this function.
    • Content data: Wishlist contents (e.g. POIs/locations/time periods) are factual. As a matter of course, no personal data is required. Please do not enter any personal information in free-text fields.

    Transfers to third countries
    Where a transfer to third countries (e.g. the USA) is required as part of the AI functionality, this is carried out on the basis of EU Standard Contractual Clauses (SCC) and supplementary safeguards in accordance with the data processing agreement concluded between the parties.

    Retention period

    • Server log data (IP): only for a short period for security/error-troubleshooting purposes; subsequently deleted or anonymised.
    • Information from the wishlist: 12 months after the last change.
    • Local identifier (LocalStorage): remains stored locally on your device until you reset or delete the wishlist or clear your browser cache.

    Obligation to provide / Necessity
    The processing of the IP address is technically necessary for accessing the page. The local identifier is required if you wish to use the wish list/continue planning function; without this identifier, the wish list will not function.

    Automated decisions / profiling
    No decisions with legal effect and no profiling take place.

7. Our social media presence

  • This privacy policy applies to the following social media platforms
    https://www.facebook.com/DeinNRW/
    https://www.instagram.com/deinnrw
    https://www.pinterest.de/deinnrw/
    https://www.youtube.com/user/tourismusnrw
    https://www.tiktok.com/@deinnrw

  • Data processing by social networks
    We maintain publicly accessible profiles on social networks. You can find the specific social networks we use listed below.

    Social networks such as Facebook, X, etc. can generally analyse your user behaviour in detail when you visit their website or a website with integrated social media content (e.g. ‘Like’ buttons or advertising banners). Visiting our social media pages triggers numerous data processing operations relevant to data protection. Specifically:

    If you are logged into your social media account and visit our social media presence, the operator of the social media portal may associate this visit with your user account. However, your personal data may also be collected even if you are not logged in or do not have an account with the relevant social media platform. In this case, data is collected, for example, via cookies stored on your device or by recording your IP address.

    Using the data collected in this way, the operators of the social media platforms can create user profiles that record your preferences and interests. In this way, interest-based advertising may be displayed to you both on and off the respective social media platform. If you have an account with the relevant social network, interest-based advertising may be displayed on all devices on which you are logged in or have previously been logged in.

    Please also note that we are not able to track all data processing activities on social media platforms. Depending on the provider, further processing operations may therefore be carried out by the operators of the social media platforms. For further details, please refer to the terms of use and privacy policies of the respective social media platforms.

  • Legal basis
    Our social media presence is intended to ensure the most comprehensive online presence possible. This constitutes a legitimate interest within the meaning of Article 6(1)(f) of the GDPR. The analysis processes initiated by the social networks may be based on different legal grounds, which must be specified by the operators of the social networks (e.g. consent within the meaning of Article 6(1)(a) of the GDPR).

  • Data controller and exercising your rights
    When you visit one of our social media pages (e.g. Facebook), we are jointly responsible with the operator of the social media platform for the data processing operations triggered by that visit. You may, in principle, exercise your rights (right of access, rectification, erasure, restriction of processing, data portability and the right to lodge a complaint) both against us and against the operator of the relevant social media platform (e.g. against Facebook).

    Please note that, despite our joint responsibility with the social media platform operators, we do not have full control over the data processing operations carried out by the social media platforms. Our options depend largely on the corporate policy of the respective provider.


  • retention period Data collected directly by us via our social media presence is deleted from our systems as soon as you request its deletion, withdraw your consent to its storage, or the purpose for storing the data no longer applies. Stored cookies remain on your device until you delete them. Mandatory legal provisions – in particular retention periods – remain unaffected.

    We have no influence over the retention period of your data stored by the operators of social networks for their own purposes. For further details, please contact the operators of the social networks directly (e.g. in their privacy policy, see below).

  • Your rights
    You have the right at any time to obtain, free of charge, information about the origin, recipients and purpose of your stored personal data. You also have the right to object, the right to data portability and the right to lodge a complaint with the relevant supervisory authority. Furthermore, you may request the rectification, restriction, erasure and, under certain circumstances, the restriction of the processing of your personal data.

Social media platforms in detail

8. Our WhatsApp newsletter

  • If you subscribe to our WhatsApp newsletter, we will process the personal data required for this purpose, in particular your mobile phone number, your WhatsApp profile name, your profile picture (if applicable), your messages to us, and technical communication, delivery and status data. This processing is carried out for the purposes of subscribing to, sending, managing and unsubscribing from the WhatsApp newsletter. The legal basis for sending the WhatsApp newsletter is your consent in accordance with Article 6(1)(a) of the GDPR. For promotional messages via WhatsApp, we also obtain prior explicit consent within the meaning of Section 7(2)(2) of the German Unfair Commercial Practices Act (UWG). Where we store data to document your subscription or unsubscription, this is done on the basis of Article 6(1)(f) of the GDPR. Our legitimate interest lies in being able to demonstrate that your consent has been properly obtained and respected.

    For the technical management of the WhatsApp newsletter, we engage ChatWerk, a service provided by Inbox Solutions GmbH, Pretzfelder Straße 7–11, 90425 Nuremberg, as a data processor. Depending on the technical setup, other service providers may be involved, in particular providers of the WhatsApp Business Platform or the WhatsApp Business API. We have entered into data processing agreements with the data processors we use in accordance with Article 28 of the GDPR.


    The WhatsApp messaging service is provided by WhatsApp Ireland Limited. When you use WhatsApp, WhatsApp processes personal data under its own responsibility for data protection in accordance with the WhatsApp Privacy Policy. This may include, in particular, account, device, usage, communication and metadata. We do not have full control over the independent data processing carried out by WhatsApp. When using WhatsApp, personal data may also be transferred to recipients outside the European Economic Area, in particular to companies within the Meta Group or other service providers. According to the providers involved, such transfers take place on the basis of appropriate safeguards or adequacy mechanisms, in particular the EU Standard Contractual Clauses or the EU-US Data Privacy Framework, provided that the relevant conditions are met.


    You may withdraw your consent at any time with future effect, for example by sending a WhatsApp message containing ‘STOP’ or ‘WITHDRAW’, or via the contact channels specified in this privacy policy. Following withdrawal, we will remove your data from the active WhatsApp newsletter distribution list. Where necessary, we will store your telephone number on a block list to ensure that you do not receive any further WhatsApp newsletters. This block list is used exclusively for this purpose.
    We generally store the data processed in connection with the WhatsApp newsletter for as long as you remain subscribed to the WhatsApp newsletter. Following unsubscription or withdrawal of consent, the data will be deleted, provided there are no statutory retention obligations or further storage is required to document consent, to prevent future mailings, or to assert, exercise or defend legal claims.

    There is no obligation to provide your data. However, without your mobile phone number and without you using WhatsApp, we cannot send you the WhatsApp newsletter via this channel.

New tips every two months

Insider tips & excursion ideas

Newsletter

Fancy some mail? Then subscribe here to our every two months newsletter with information on special travel offers, selected short tips for short trips and other insider tips for travelling in North Rhine-Westphalia.

Click here to register