Controller
Harzer Hexenreich GmbH
Alte Leipziger Straße 50
99734 Nordhausen
Phone: 03631 / 46 29 90
Email: info@hex-erlebniswelt.de

Data Protection Officer:
Veronika Töpfer, Site Manager

We treat your personal data confidentially and in accordance with legal requirements (GDPR, TDDDG).

Retention period
Data is deleted as soon as the purpose for processing no longer applies, and no later than the expiration of statutory retention periods.

Legal basis

• Consent (Art. 6(1)(a) GDPR)
• Performance of a contract (Art. 6(1)(b) GDPR)
• Legal obligation (Art. 6(1)(c) GDPR)
• Legitimate interest (Art. 6(1)(f) GDPR)

‍

Shopify
We use Shopify to host our online shop. This involves processing data including IP addresses, browser information, and order details.
➡️ Details: Shopify Privacy Policy

Webflow
Our website is provided via Webflow. Log data such as IP addresses and browser information are collected.
➡️ Details: Webflow Privacy Policy

Amazon CloudFront (CDN)
We use CloudFront for fast content delivery. Your IP address is processed during this process.
➡️ Details: AWS Privacy

Bunny.net (Video Hosting)
We host our videos on Bunny.net. When you view them, your IP address and technical data are transmitted.
➡️ Details: Bunny.net Privacy

‍

We use cookies to enable functionality, security, and analytics.

Consent Tools

• Finsweet Cookie Consent Pro: manages your consent and stores it.
• Shopify GDPR Legal Cookie: manages cookie settings in the shop.

You can change your cookie settings at any time. The website may have limited functionality without necessary cookies.

Google Analytics
We use Google Analytics to analyze visitor traffic. Pseudonymized data (e.g., truncated IP addresses) is processed for this purpose.

➡️ Details: Google Privacy Policy

Shopify Payments & Payment Services
When you make a purchase in our shop, we process your data to fulfill your order. Payment details are encrypted and transmitted to the respective payment provider.

N-Tree Ticket Shop System
We use N-Tree Solutions for ticket purchases. Personal data (e.g., name, address, payment information) is processed there.
➡️ Details: N-Tree Privacy Policy

Customer Data
Data such as name, address, email, phone number, and purchase history are stored for the fulfillment of contracts.

‍

Mapbox
We use Mapbox to display interactive maps. Your IP address is transmitted to Mapbox for this purpose.
➡️ Details: Mapbox Privacy Policy

Social Media Plugins

• Facebook & Instagram (Meta Platforms Ireland Ltd.)
  When clicking on social media elements, data such as your IP address may be transmitted to Meta.

‍

Contact form
If you contact us via a form, we store your details (name, email, message) for processing purposes.

Email / Phone / Fax
Inquiries, including your contact details, are stored by us and used exclusively for processing your request.

When you apply for a position with us, we process your application documents exclusively for the purpose of conducting the application process.

• Application documents are deleted after no more than 6 months.
• Longer retention only occurs with your consent.
• Note: Applications sent via email are not technically end-to-end encrypted.

‍

You have the right at any time to:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection / Withdrawal (Art. 21 GDPR)

‍

• SSL/TLS encryptionAll data transfers are encrypted.
• Data processors: Data processing agreements are in place with all service providers (Shopify, Webflow, CloudFront, Bunny.net, Mapbox, N-Tree, Google).
• Right to lodge a complaint: You may lodge a complaint with the competent data protection authority if you suspect any violations.