1. Who we are and how to contact us

The party responsible for this website and the processing of your data is:

K & R Navigator UG (limited liability)
Würselener Straße 24
50933 Cologne

Represented by Managing Director Robert Richstein

Phone: +49 175 6392246
Email: info@koelner-kompass.de

Here, we explain what data we collect during your visit, why we need it, and what you can do if you do not agree with this. Personal data is any information that can be traced back to you as an individual, such as your name, email address, or IP address. In principle, you can read our site without providing any personal data. However, for technical reasons, some data is generated automatically; more on this in the next section.

2. What happens when you visit our site

Hosting and site delivery

To ensure your browser receives our site reliably and quickly, we use three technical service providers. Log data is processed with every visit: your IP address, the requested file, the page you came from, the date and time, the amount of data transferred, and the success status. We use this data solely to provide the site without errors, identify malfunctions, and improve our services, without analyzing you as an individual. The legal basis is our legitimate interest in a secure and stable website (Art. 6(1)(f) GDPR).

Webflow hosts this site. The provider is Webflow, Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA. Webflow uses technically necessary cookies to ensure the site is displayed correctly and remains secure. We have a data processing agreement in place with Webflow. Webflow is certified under the EU-U.S. Data Privacy Framework (DPF) (https://www.dataprivacyframework.gov/participant/6365). More information: https://webflow.com/legal/eu-privacy-policy.

Cloudflare routes traffic between your browser and our site, filtering out malicious access. The provider is Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cookies or similar technologies may be used solely for this security purpose. Cloudflare is certified under the DPF (https://www.dataprivacyframework.gov/participant/5666). More information: https://www.cloudflare.com/privacypolicy/.

Amazon CloudFront delivers images and other files via a global network to ensure the site loads quickly everywhere. The provider is Amazon Web Services EMEA SARL, 38 avenue John F. Kennedy, L 1855 Luxembourg. Amazon is certified under the DPF (https://www.dataprivacyframework.gov/participant/5776). More information: https://d1.awsstatic.com/legal/privacypolicy/AWS_Privacy_Notice__German_Translation.pdf.

If consent is requested, for example because information is being stored on or read from your device, we rely solely on that consent (Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG). You can withdraw your consent at any time.

Encrypted connection

Our site uses SSL/TLS encryption. You can recognize this by the "https://" in the address bar and the padlock icon. This prevents third parties from reading what you send to us, including during payment.

3. Your cookie preferences

Cookies are small text files that your browser saves on your device. Some are necessary for the site to function, for example to ensure it displays correctly. We store these on the basis of Article 6(1)(f) of the GDPR. We only set all other cookies, such as those for statistics or advertising, if you have given your prior consent (Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG). You can configure your browser to notify you about cookies, allow them only in individual cases, or delete them when closing the browser. If cookies are disabled, the site's functionality may be limited.

Cookie Script requests your consent and documents it. The provider is Objectis Ltd., Žalgirio st. 88, LT 09303 Vilnius, Lithuania. When you access the site, your browser connects to their servers and a cookie is set so that your selection or withdrawal of consent can be assigned. The data remains stored until you ask us to delete it, remove the cookie yourself, or the purpose for storage no longer applies. Statutory retention obligations remain unaffected. You can change your selection at any time. We use this tool because we are required to provide proof of consent (Article 6(1)(c) of the GDPR).

4. When you book a tour

Online booking with Regiondo

You can book tours and vouchers with us via the booking system of Regiondo GmbH, Mühldorfstraße 8, 81671 Munich. It is integrated into our site as a widget, for example for the public brewery tour and vouchers. The widget loads from Regiondo's servers (widgets.regiondo.net). In the process, technical data such as your IP address may be sent to Regiondo.

When you make a booking, we process the information you enter, such as your name, contact details, booking data, and payment information. We use this to process your booking, provide your tour or voucher, and handle the payment. The legal basis is Article 6(1)(b) of the GDPR. Furthermore, our legitimate interest in providing a simple online booking process applies to the technical provision of the widget (Article 6(1)(f) of the GDPR). We only pass on your data if it is necessary for processing, for example to payment service providers. Data is not passed on for advertising purposes without your express consent.

Payments are processed as part of the booking process via Regiondo and the payment service providers integrated there. Depending on the payment method, your payment data is sent to the respective provider. We do not store full payment details, such as credit card numbers, ourselves. We delete your customer data after the order has been completed or the business relationship has ended, provided there are no statutory retention obligations to the contrary. More information on data protection at Regiondo: https://pro.regiondo.com/de/datenschutz/.

Booking inquiry and contact form

You can write to us using the contact form or booking inquiry form, for example for a private brewery tour or a city rally. We store the information you provide in the form—namely your name, contact details, and your message—in order to respond, prepare a quote, and address any potential follow-up questions. The forms are processed via our website provider, Webflow, which temporarily stores the entries and forwards them to us. We do not share this information with third parties without your consent.

The legal basis is Article 6(1)(b) of the GDPR if your request is related to a contract or involves pre-contractual measures. In all other cases, processing is based on our legitimate interest in effectively handling inquiries (Article 6(1)(f) of the GDPR) or on your consent (Article 6(1)(a) of the GDPR), if we have requested it. We delete the information once the request has been resolved and you have not requested earlier deletion, unless a statutory retention period requires otherwise.

Email and telephone

If you contact us via email or telephone, we process your details, such as your name and the nature of your request, in order to handle your inquiry. The legal bases are the same as those for the forms. We delete the data as soon as the matter has been resolved, unless statutory retention periods apply.

Applications

If you are interested, you can apply to work with us, for example as a guide, via email or by using a form. We only process the information you send us for the purpose of handling your application. The legal basis for this is Article 6(1)(b) of the GDPR in conjunction with Section 26 of the German Federal Data Protection Act (BDSG), insofar as it is necessary for the decision regarding an employment relationship. If you grant us permission to store your data for a longer period, your consent applies (Article 6(1)(a) of the GDPR). We will delete your application data as soon as it is no longer required for the decision-making process and there are no statutory retention obligations to the contrary.

5. When you view third-party content

Google Maps

We may display Google Maps, for example for meeting points and directions. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you load a map, your browser connects to Google. Data such as your IP address, location information, and details about your use of the map may be sent to Google, including to the USA. If you are logged into Google, Google can associate this usage with your account. The legal basis is our interest in a clear presentation of meeting points (Art. 6(1)(f) GDPR); if consent was requested, then that (Art. 6(1)(a) GDPR and Section 25(1) TDDDG). More: https://policies.google.com/privacy?hl=en. Google is certified under the DPF (https://www.dataprivacyframework.gov/participant/5780).

YouTube videos

We may embed videos from YouTube. The operator is Google Ireland Limited (address above). If you open a video, your browser connects to YouTube, and YouTube learns which of our pages you have visited. If you are logged into YouTube, it can associate this with your profile. You can avoid this by logging out beforehand. We use the enhanced privacy mode. According to YouTube, this means browsing is not personalized, no cookies are set, and ads are not personalized. Instead, elements may be stored in your browser's local storage, which can serve to identify you similarly to cookies. The legal basis is our interest in an engaging presentation (Art. 6(1)(f) GDPR); if consent was requested, then that (Art. 6(1)(a) GDPR and Section 25(1) TDDDG). More: https://policies.google.com/privacy?hl=en and https://support.google.com/youtube/answer/171780.

Third-party reviews

We may display reviews from providers such as Google, Trustpilot, or ProvenExpert. If such a widget is embedded, your browser connects to the provider when you visit the page, and data such as your IP address, browser information, time, and pages visited may be sent there. The legal basis is our interest in transparently displaying customer reviews (Art. 6(1)(f) GDPR); if consent was requested, then that (Art. 6(1)(a) GDPR and Section 25(1) TDDDG). If we display reviews only as an image, no data transfer takes place.

Social networks

We may link to our profiles on social networks. These are simple links. Clicking them takes you away from our site and to the respective platform. Only then does the provider process your data under its own responsibility. Their privacy policy applies there.

6. When we evaluate site usage and measure advertising

The services in this section are only used after you have given your consent in the cookie banner. We integrate them as needed via Google Tag Manager. Google is certified under the DPF (https://www.dataprivacyframework.gov/participant/5780).

Google Tag Manager (Google Ireland Limited, address above) manages the tools we integrate. It does not create user profiles, store cookies, or perform evaluations itself. However, it does capture your IP address, which may be sent to Google in the USA. The legal basis is your consent (Art. 6(1)(a) GDPR and Section 25(1) TDDDG), or alternatively our interest in efficiently managing our tools (Art. 6(1)(f) GDPR).

Google Analytics 4 shows us how our site is used: page views, time spent, operating system, origin, as well as clicks and mouse/scroll movements. The data is assigned to the device, not a user ID. Google supplements the data with modeling and machine learning and may use cookies or device recognition for identification. According to Google, Analytics 4 does not store IP addresses. Information is generally sent to servers in the USA. The legal basis is solely your consent (Art. 6(1)(a) GDPR and Section 25(1) TDDDG). The transfer is based on standard contractual clauses (https://business.safety.google/adscontrollerterms/sccs/). If you want to permanently prevent tracking, you can use the browser plugin at https://tools.google.com/dlpage/gaoptout?hl=en. More: https://support.google.com/analytics/answer/6004245?hl=en.

Microsoft Clarity shows us how visitors use our site so we can improve it. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, a company of Microsoft Corporation, USA (hereinafter "Microsoft"). Clarity records your behavior on our site, such as clicks, scrolling, mouse movements, pages visited, time spent, device, browser, and approximate location. This creates heatmaps and recordings of your visit that we can review later. This helps us identify which areas work well and where guests get stuck, for example during the booking process. Entries in form fields, such as names or email addresses, are masked and not stored in plain text. Clarity uses cookies and similar technologies for this. Microsoft processes your IP address to determine your approximate location and, according to Microsoft, does not store it in the evaluations. The legal basis is solely your consent (Art. 6(1)(a) GDPR and Section 25(1) TDDDG). You can revoke this at any time with effect for the future, for example via the settings in the cookie banner. Microsoft processes the data on our behalf, and we have a data processing agreement in place with them. Data may also be transferred to the USA. Microsoft is certified under the DPF, and the transfer is additionally based on the EU Commission's standard contractual clauses. We only keep the evaluations for as long as we need them to improve the site. More: https://privacy.microsoft.com/en-us/privacystatement.

Google Ads, Remarketing, and Conversion Tracking are used for ads in Google search or on third-party sites. Ads can be displayed based on search terms, location, and interests. With remarketing, we assign people who have interacted with our offerings to target groups and show them interest-based advertising within the Google advertising network, including across devices. With conversion tracking, Google and we can determine whether an action, such as a booking or a submitted form, occurs after an ad click. Cookies or similar technologies may be used for this purpose. We do not receive information that allows us to identify you personally. Google may process the data under its own responsibility. The legal basis is solely your consent (Art. 6(1)(a) GDPR and Section 25(1) TDDDG). If you have a Google account, you can opt out of personalized advertising at https://adssettings.google.com/anonymous?hl=en. Transfers to the USA are based on standard contractual clauses (https://policies.google.com/privacy/frameworks and https://business.safety.google/controllerterms/). More: https://policies.google.com/technologies/ads?hl=en.

Google Search Console (same provider) shows us how our site is found in Google search results so that we can improve it technically. To our knowledge, it does not place cookies on your device and does not analyze individual users for us. The legal basis is our interest in optimization and discoverability (Art. 6(1)(f) GDPR).

Meta Pixel (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland) shows us how visitors behave after reaching us via a Facebook or Instagram ad. Data such as IP address, browser information, page views, and interactions may be sent to Meta. For us, this data is anonymous. However, Meta may store and process it, making it possible to link it to a user profile. The legal basis is solely your consent (Art. 6(1)(a) GDPR and Section 25(1) TDDDG). More: https://www.facebook.com/privacy/policy/. Meta is certified under the DPF (https://www.dataprivacyframework.gov/participant/4452).

LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland) helps us analyze visits and measure the effectiveness of LinkedIn ads. This may involve processing IP addresses, device and browser information, timestamps, and details about page views and interactions. LinkedIn creates anonymized reports for us. We do not identify individual persons. The legal basis is solely your consent (Art. 6(1)(a) GDPR and Section 25(1) TDDDG). More: https://www.linkedin.com/legal/privacy-policy. LinkedIn is certified under the DPF (https://www.dataprivacyframework.gov/participant/5448).

Cloudflare Turnstile is used as needed for spam protection to verify that input is coming from a human. To do this, it analyzes your IP address, time spent on the site, and mouse movements, among other things, and transmits the data to Cloudflare (address above). This is based on our interest in protecting against misuse and spam (Art. 6(1)(f) GDPR). Where information is stored on or read from your device, your consent applies (Art. 6(1)(a) GDPR and Section 25(1) TDDDG). The transfer is based on standard contractual clauses (https://www.cloudflare.com/cloudflare-customer-scc/). More: https://www.cloudflare.com/cloudflare-customer-dpa/.

7. Where your data goes

Some of our service providers are based in the USA. For recipients certified under the DPF, a level of protection comparable to that in the EU applies there. For all others, we rely on the EU Commission's standard contractual clauses. In countries without such guarantees, we cannot ensure a level of protection equivalent to that in the EU.

We only share your data if it is necessary for a contract, if we are legally obligated to do so (e.g., to tax authorities), if there is a legitimate interest, or if another legal basis permits it. We only provide data to service providers working on our behalf based on a data processing agreement.

8. How we work and how long we store data

We only process data if there is a legal basis for doing so, which we specify for each service. In short: your consent (Art. 6(1)(a) GDPR, or Art. 9(2)(a) GDPR for special categories of data), a contract or steps prior to entering into a contract (lit. b), a legal obligation (lit. c), or our legitimate interest (lit. f). For explicit consent to transfers to third countries, Art. 49(1)(a) GDPR also applies.

We store data for as long as we need it for the intended purpose. If you rightfully request deletion or withdraw your consent, we will delete it. An exception applies to statutory retention periods under tax and commercial law. In those cases, we will delete the data once these periods have expired.

9. Your rights

Access and correction. You can find out at any time, free of charge, what data we store about you, where it comes from, who receives it, and what we use it for. If something is incorrect, you can request a correction.

Deletion and restriction. You can request deletion if we no longer have a reason to store your data. You can also request that we restrict processing: while we verify the accuracy of your data, if the processing was unlawful and you do not want deletion, if we no longer need the data but you require it for legal claims, or if you have objected and it is still being determined whose interests prevail. We may then only store the restricted data. Any further use is only permitted with your consent, for legal claims, to protect others, or for reasons of important public interest.

Data portability. You can receive the data you provided to us based on your consent or a contract, which we process by automated means, in a common, machine-readable format, or have it transmitted to another controller, where technically feasible.

Withdrawal of consent. You can withdraw any consent you have given us at any time with effect for the future; the easiest way is via the cookie banner or by email. Processing that took place before the withdrawal remains lawful.

Complaints. You have the right to lodge a complaint with a supervisory authority, for example in the country where you live or work, or where the alleged infringement occurred. Other legal remedies remain unaffected.

Your right to object

If we process your data based on our legitimate interests (Art. 6(1)(e) or (f) GDPR), you may object to this at any time for reasons arising from your particular situation. This also applies to profiling based on these provisions. We will then no longer process the data in question unless we can demonstrate compelling legitimate grounds that override your interests, or if the processing serves the establishment, exercise, or defense of legal claims (Art. 21(1) GDPR).

If we use your data for direct marketing, you can object to this at any time without providing a reason. This also applies to profiling, insofar as it is related to such advertising. We will then no longer use your data for this purpose (Art. 21(2) GDPR).

How to reach us with your requests

For information, deletion, correction, objections, or simply if you have a question, just write or call us:

K & R Navigator UG (haftungsbeschränkt)
Würselener Straße 24
50933 Cologne
Email: info@koelner-kompass.de
Phone: +49 175 6392246

10. Changes to this policy

We will update this policy if the legal situation, our offerings, or the services we use change.

‍