Само немската версия на този правен текст е обвързваща. Deutsche Fassung

Privacy Policy

Last updated: 1 Nov 2026

1. Controllers

The website gera-tours.de in general (visiting the pages, puzzle route, public vote): ZS Holding EOOD, representative office Germany, Theaterstraße 4, 07545 Gera, Germany, e-mail: info@zs.holdings, phone: +49 170 4790000.

Photo contest (submissions, management and use of the entries, awarding of prizes): Promenaden Service UG (haftungsbeschränkt), Theaterstraße 2–4, 07545 Gera, Germany, e-mail: info@promenaden-hotel.de. ZS Holding EOOD operates the technology for this (hosting, storage, sending e-mails) as a processor under Art. 28 GDPR on behalf of Promenaden Service UG.

2. Principles

This website works without tracking, without advertising and without third-party analytics services. Fonts and program libraries are loaded from our own server. Only technically necessary cookies are set, which is why there is no cookie banner.

3. Hosting and server logs

The website runs on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data centre in Germany. When you visit the site, the server processes technically necessary data (IP address, time, page requested, browser identifier) in order to deliver the page and to fend off attacks. Logs are deleted after 14 days at the latest. Legal basis: Art. 6(1)(f) GDPR (secure operation). A data processing agreement is in place with Hetzner.

To protect against misuse (e.g. too many attempts within a short time), we store a hash value that changes daily instead of the IP address, for no longer than 24 hours.

4. Cookies and local storage

“lang” remembers the language you selected (1 year). “gt_sess” is a session cookie that protects forms (deleted when you close the browser). In your browser’s local storage we remember your team’s code so that you can continue playing at the next QR code. This data does not leave your device. Legal basis: Section 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act), Art. 6(1)(f) GDPR.

5. Puzzle route (teams)

For a team we store the team name you chose, the route, the stations solved and the points. Please do not use real names as team names if you do not want to. Teams that have solved their secret word appear in the leaderboard with their team name and score. Team data is deleted after 12 months. Legal basis: Art. 6(1)(b) GDPR (use of the service).

We count anonymously how often stations and pages are visited and how often the “Book hotel” links and the links to the hotel website are clicked. We only store the date, the page, the selected language and – if the browser provides it – the domain name of the website the visit came from (e.g. “google.com”). No cookies are set for this and no IP addresses or other personal data are stored; it is not possible to identify individual persons. Legal basis: Art. 6(1)(f) GDPR (improving the service).

6. Photo contest

When you submit an entry, we process your name, e-mail address, your confirmation that you are at least 18 years old, the place where the photos were taken, the title, the description and the photos and videos. Embedded metadata in photos and videos (e.g. EXIF, camera data, GPS location) is removed during upload. Only approved entries are published, with first name and initial of the surname as well as title and place; on request (option when submitting) without a name. Legal basis: Art. 6(1)(b) GDPR (participation in accordance with the contest terms).

We delete the contact details of participants who did not win three months after the end of the respective round. The names belonging to published entries remain stored for crediting the author for as long as the entry is published.

7. Public vote

To vote, you enter an e-mail address to which we send a confirmation link. Only an encrypted hash value of the address is stored so that each address counts only once per round. We do not store the address itself. Legal basis: Art. 6(1)(b) GDPR.

8. Sending e-mails and storing entries

We send e-mails via Microsoft 365. The submitted photos and videos are also stored together with the title, name, place and proof of consent to the contest terms (without e-mail address) in a protected Microsoft 365 storage (OneDrive), which ZS Holding EOOD operates as a processor on behalf of Promenaden Service UG, so that the organiser can manage the entries and prove the rights of use granted. The provider in each case is Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. A data processing agreement is in place with Microsoft; a transfer to the USA is possible on the basis of the EU-US Data Privacy Framework.

9. Map (OpenStreetMap)

The route map is only loaded when you tap “Load map”. Map tiles are then retrieved from servers of the OpenStreetMap Foundation (St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom), and your IP address is transmitted in the process. An adequacy decision of the EU Commission exists for the United Kingdom. Legal basis: Art. 6(1)(a) GDPR (your consent by clicking). “Show the way” links open Google Maps in a new window only after you click them.

10. Read-aloud function

The read-aloud function uses the speech output of your own device. No data is sent to us for this.

11. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to withdraw consent at any time. To do so, write to info@zs.holdings. You can also lodge a complaint with a data protection supervisory authority, e.g. the Thuringian State Commissioner for Data Protection and Freedom of Information (Thüringer Landesbeauftragter für den Datenschutz und die Informationsfreiheit), Häßlerstraße 8, 99096 Erfurt, Germany.