Privacy Policy City of Bocholt

By visiting our website https://www.bocholt.de, the Bocholt municipal administration provides you with a telemedia service within the meaning of the Telemedia Act. The operator of these pages takes the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this data protection declaration. The following information provides a simple overview of what happens to your personal data when you visit our website or use other administrative services.

I. General information pursuant to Article 13 of the General Data Protection Regulation (GDPR)

1. contact details

1.1 Name and address of the responsible body

Responsible for this website is the

Bocholt City Council
The Mayor
Kaiser-Wilhelm-Str. 52-58
46395 Bocholt

Tel.: 02871/953-0
E-mail: Stadtverwaltungverwaltung(at)bocholt(dot)de
DE-Mail: Stadtverwaltungverwaltung(at)bocholt.de-mail(dot)de
URL: https: //www.bocholt.de

1.2 Name and address of the data protection officer

In accordance with Art. 37 Para. 3, the city administration of Bocholt has appointed a joint official data protection officer who looks after several local authorities. Information on the institution and the data protection officer is as follows

Zweckverband KAAW - Kommunale ADV-Anwendergemeinschaft West
Weberstraße 5
49477 Ibbenbüren
Germany

Mario Könning
Workplace/location: Borken town hall
Phone: +49 (2861) 939409 or +49 (0)5451 5622-751
e-mail: Send e-mail

1.3 Name and address of the data protection supervisory authority

The competent supervisory authority for data protection is the

State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia
Kavalleriestr. 2-4
40213 Düsseldorf

Telephone: 0211/38424-0
Fax: 0211/38424-10
E-mail: poststelle(at)ldi.nrw(dot)de

2. your rights as a user

As a data subject within the meaning of the GDPR, you have the opportunity to assert various rights. You have the right

• pursuant to Art. 15 GDPR i.V.m. §§ Sections 12, 49 DSG NRW to request information about your personal data processed by us. In particular, you can request information about the processing purposes, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the origin of your data if it was not collected by us, as well as the existence of automated decision-making including profiling and, if applicable, meaningful information on its details. Please note that your right to information may be restricted or excluded in certain cases in accordance with Section 48 of the State Data Protection Act of North Rhine-Westphalia.
• pursuant to Art. 16 GDPR in conjunction with. § to demand the immediate correction of incorrect data or the completion of your personal data stored by us;
• in accordance with Art. 17 GDPR in conjunction with. § Section 50 (2) DSG NRW to demand the deletion of your personal data stored by us if this is required by law. However, the right to erasure pursuant to Art. 17 (1) and (2) GDPR does not apply if, among other things, the processing of personal data is necessary for the performance of a task carried out in the public interest or for the establishment, exercise or defence of legal claims;
• pursuant to Art. 18 GDPR in conjunction with. to demand the restriction of the processing of your personal data if the accuracy of the data is disputed by you, the processing is unlawful, but you refuse to delete it and we no longer need the data, but you need it for the assertion, exercise or defence of legal claims or you object to the processing of your personal data in accordance with Art. 21 GDPR in conjunction with § 14 DSG NRW. § 14 DSG NRW have lodged an objection to the processing;
• in accordance with Art. 20 GDPR, to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format or to request that it be transmitted to another controller
• in accordance with Art. 21 GDPR in conjunction with. § 14 DSG NRW, you have the right to object, on grounds relating to your particular situation, at any time to processing of your personal data which is based on point (a) or (e) of Article 6(1) GDPR. The controller will then no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims. The collection of data for the provision of the website and the storage of log files are absolutely necessary for the operation of the website. Please send your objection to this email address.
• In accordance with Art. 7 para. 3 GDPR, you have the right to revoke your consent to us at any time. The consequence of this is that we may no longer continue the data processing based on this consent in the future and
• to lodge a complaint with a supervisory authority in accordance with Art. 77 GDPR. As a rule, you can contact the supervisory authority of your usual place of residence for this purpose.

3. general communication with the city administration of Bocholt

a) What data is processed for what purpose?

We offer you various access options for "electronic" communication when contacting the Bocholt city administration:

• Contact form
• E-mail communication
• DE-Mail communication
• Telephone system (answering machine: recording on tape)
• User account (website)

The following can be saved when you contact us

• Salutation
• First name
• Surname
• e-mail address
• Street address
• House number
• Postcode
• Town
• Telephone number
• Subject
• Your message / your content
• Timestamp
• IP address

The purpose of data processing and storage is to be able to respond to your request.

b) What is the legal basis for processing this data?

If you use one of the communication media, personal data is entered on an expressly voluntary basis. The legal basis for processing is Article 6(1)(a) GDPR. If your enquiry and the medium used is an administrative act, we process this information in accordance with Article 6(1)(e) GDPR.

Persons under the age of 16 should not transmit any personal data to us unless the consent of their parents or legal guardians has been given (Art. 8 (1) GDPR). The consent must then be expressly noted in the message (Art. 8 para. 2 GDPR).

c) Are there other recipients of the personal data in addition to the controller?

We only use the personal data you have entered for the purpose you have requested and only within the administration or the specialist offices responsible for the respective service.

If it is an official request that is not the responsibility of our city administration, we assume that you agree that we may forward your enquiry to the responsible public institution (e.g. district, state, federal government, etc.) so that we can deal with your request. We will only pass on your request in connection with public institutions.

d) How long will the data be stored?

We delete the personal data that we receive via communication as soon as storage is no longer required for the purpose pursued by you or in connection with the administrative processes triggered by it and the applicable retention obligations.

e) Note on e-mail communication

We expressly point out that you communicate electronically by e-mail at your own risk. The city administration of Bocholt cannot guarantee that a message received is secure against interception or falsification.

Please use your DE-Mail address or our contact form for secure communication.

f) Notes on tape recordings (answering machine)

We would like to point out that if your spoken word is recorded by the answering machine and the content is decisive for the implementation of an administrative act, we will process (store) this information for the intended purpose.

Data processing when visiting our website (DSGVO)

4. External links

This website may contain links to third-party websites or to other websites for which we are responsible. If you follow a link to a website outside our control, please note that these websites have their own privacy policies. We accept no responsibility or liability for these external websites or their privacy policies. You should therefore check whether you agree with the privacy policies on those websites before using them.

You can recognise external links either by the fact that they are displayed in a slightly different colour to the rest of the text or by being underlined. Your cursor will highlight external links when you move it over them. Your personal data will only be transferred to the destination of the link once you click on an external link. In doing so, the operator of the other website receives, in particular, your IP address, the time at which you clicked the link, the page on which you clicked the link, and further information which you will find in the privacy policy of the respective provider.

Please also note that some links may result in data being transferred outside the European Economic Area. This could allow foreign authorities to gain access to your data. You may not have any legal remedies against such access to your data. If you do not wish your personal data to be transferred to the link destination or, indeed, to be exposed to unauthorised access by foreign authorities, please do not click on any links.

5. Web hosting provider

a) What data is processed and for what purpose?

When you access content on the website, the browser used on your device automatically sends information to our website's server. This information is temporarily stored in a so-called log file, which may allow for identification. The following data is collected in this process:

• Server name
• Amount of data transferred
• Internet Protocol address (IP address)
• Date and time of access
• Purpose of the request
• Status of the request
• Website from which the user accessed the server
• Web browser used, operating system of your computer (if applicable), and name of your internet service provider

We process the aforementioned data (log files) for the following purposes:

• To ensure the website connects smoothly
• To ensure a user-friendly experience on our website
• To assess system security and stability
• Criminal prosecution in the event of misuse, as well as
• for other administrative purposes

b) On what legal basis is this data processed?

The legal basis for the temporary storage of the data is Section 3(1) of the Data Protection Act of North Rhine-Westphalia (DSG NRW) in conjunction with Article 6(1)(e) and (3) of the General Data Protection Regulation (GDPR).

c) Are there any recipients of the personal data other than the data controller?

Instead of operating this website on our own server, we may also have it hosted on the server of an external service provider (hosting company). In this case, the personal data collected on this website is stored on the hosting company's servers. In addition to the data mentioned above, this may include, for example, contact enquiries, contact details, names, website access data, meta and communication data, contractual data and other data generated via a website. You can find out more about this under the heading "configurable forms". Our website service provider is:

EGOTEC AG
Executive Board: Heiko Roth, Johannes Jakob
Chair of the Supervisory Board: Silvia Jakob
Pfalzgraf-Otto-Straße 81

74821 Mosbach
info(at)egotec(dot)com

EGOTEC collects and processes personal data on behalf of others as a data processor. Our website is hosted and operated in Germany by:

Hetzner Online GmbH
Industriestr. 25
91710 Gunzenhausen

This service provider (Hetzner Online GmbH) is a sub-contractor of EGOTEC AG and also processes the data exclusively within the framework of a data processing agreement.

d) How long is the data stored?

The data is deleted as soon as it is no longer required to fulfil the purpose for which it was collected. In the case of the website, this is the case once the relevant session has ended. The log files are retained for up to thirty days and are accessible directly and exclusively to administrators.

6. Website user account

a) What data is processed and for what purpose?

As a user of our website, you have the option to set up a user account. This is done either in conjunction with the ServiceKonto NRW or by entering your details manually. The user account is used for various purposes. On the one hand, the details you provide enable forms provided by us to be automatically filled in with your master data; on the other hand, the user account is required to subscribe to the newsletter.

The user account is not a prerequisite for using our administrative processes. You can therefore use our website even without a user account.

b) On what legal basis is this data processed?

The legal basis for the temporary storage of the data is your consent in accordance with Article 6(1)(a) of the GDPR.

c) Are there any recipients of the personal data other than the data controller?

The user account forms part of our content management system. Consequently, our service provider processes the data on our behalf. For further details, please refer to section 5(c).

d) How long is the data stored?

The data will be deleted as soon as it is no longer required to fulfil the purpose for which it was collected. As a rule, the user account is deleted by you. If the City of Bocholt detects a period of inactivity lasting three years, the system will automatically delete the account.

7. Newsletters (email and messenger services)

a) What data is processed and for what purpose?

A valid user account is required to subscribe to a newsletter. The user account serves as a verification process and enables you to subscribe to our newsletters:

- Economic Development Newsletter

- City marketing newsletter

- City of Bocholt newsletter

Depending on the newsletter, the following data may be processed:

- Personal details such as names

- Address details

- Communication data such as email addresses and telephone numbers

- IT data such as IP addresses

- Login and registration data

We process the aforementioned data for the following purposes

- To keep you informed as part of our news updates.

b) On what legal basis is this data processed?

The legal basis for the temporary storage of the data is Article 6(1)(a) of the EU GDPR, based on your consent.

c) Are there any recipients of the personal data other than the data controller?

When you subscribe to a newsletter, the data collected is used exclusively for the purposes of the newsletter. The data is not, as a rule, transferred to any third parties.

The City of Bocholt uses a module provided by its website operator to send out the newsletter. The website operator, as detailed in section 5(c), processes the data on behalf of the City. If you receive information from us via a messaging service, we process your personal data jointly with the messaging service provider. The relevant messaging service initially processes both your information and ours. To ensure data protection is upheld, we have commissioned the services of Whappodo.com GmbH. This service provider processes the data from the messaging services on our behalf in order to provide you with the newsletter or information via this communication channel

d) How long is the data stored?

The data will be deleted as soon as it is no longer required to fulfil the purpose for which it was collected, or if you have withdrawn your consent. If you object to the processing of your data in this regard, your personal data will be deleted immediately.

d) Withdrawal of consent

The user concerned may cancel their subscription to the newsletter at any time, either by deactivating it in their user account. A link or notice to this effect can be found in every newsletter.

Exception: Newsletters via Threema and Telegram. To unsubscribe, please send the word 'STOP'.

d) Information on messaging services

We use the so-called double opt-in procedure for subscribing to our newsletter. This means that, after you have registered, we will send an email to the email address you provided, asking you to confirm that you wish to receive the newsletter. If you do not confirm your subscription within a specified period, your details will be blocked and automatically deleted after a certain period of time.

Whappodo.com

We use the Whappodo service. Whappodo is a central platform that enables us, the City of Bocholt, to integrate various messaging services so that we can communicate with you via a central user interface. The service provider therefore processes your data on our behalf, which you make available to us via the messaging services you use.

The service provider's privacy policy also applies, amongst other things: https://www.whappodo.com/datenschutz/

Telegram Messenger

If you use Telegram in conjunction with us, please refer to the service provider's terms of use and privacy policy: https://telegram.org/privacy

Threema Messenger

If you use Threema with us, please refer to the service provider's terms of use and privacy policy: https://threema.ch/de/privacy

8. Forms

Our website uses various forms and form creation systems. We either provide you with the relevant forms via our Content Management System (CMS) (section 8.1) or use a form management system (section 8.2), which generally offers you administrative services as part of the digitalisation process. You can find further details in the following sub-sections.

8.1 Configurable forms (CMS)

a) What data is processed and for what purpose?

Our website contains configurable forms. This enables Bocholt City Council to create forms such as contact forms, feedback forms, etc. Personal data may be processed via a configurable form. We explain which configurable forms we use in the following sub-sections, starting from section 6.1.1.

b) On what legal basis is this data processed?

The legal basis for the processing of your data within the context of a configurable form is generally Article 6(1) of the GDPR. Depending on the content of the form, you can find the legal basis in the following sub-sections or feel free to enquire with the Data Protection Officer.

c) Are there any recipients of the personal data other than the data controller?

The processing is carried out on our behalf by our hosting provider. Further information on the hosting provider can be found under section 5 (Web host). Depending on the content of the form, other internal or, in rare cases, external bodies may be involved. You can find further details in the relevant subsection for the respective form.

d) How long is the data stored?

We delete the personal data we receive via the form as soon as storage is no longer required for the administrative processes it has triggered and the applicable retention obligations. For more detailed information on deletion, please refer to the relevant information requirements in the individual forms.

8.1.1 Contact form

a) What data is processed and for what purpose?

In section 3, we have already provided you with detailed information about communication between you and Bocholt Town Council. The contact form offers you a secure means of communication. For further information on the purposes, please refer to section 1, section 3.

b) On what legal basis is this data processed?

The legal basis for making initial contact is generally Article 6(1)(a) of the GDPR. A detailed description is provided in section 3(b).

c) Are there any recipients of the personal data other than the controller?

We have already provided you with detailed information about the recipients in sub-sections 3 and 8.1. Please do have a look.

d) How long will the data be stored?

In section 3(d), we have already provided you with detailed information on retention periods in the context of communication with the city administration.

8.2 Online forms (form management)

a) What data is processed and for what purpose?

The forms provided process your personal data in accordance with your enquiry or in connection with the administrative procedures triggered by it. These services are accessed via an external link. As we are also the operators of the form server, we are providing you with this privacy notice.

As a rule, we collect your personal details, address details, contact details and, depending on your enquiry, further information. Specific information on data protection relating to the relevant administrative process can be found in the information notices accompanying the relevant forms (further details can be found in section 3 of this privacy policy).

b) On what legal basis is this data processed?

The legal basis for the processing of your data is generally

Article 6(1)(e), (c) or (d) of the GDPR

Other legal bases may also apply, depending on the form:

Article 6(1)(a) of the GDPR

Article 6(1)(b) of the GDPR

c) Are there any recipients of the personal data other than the controller?

If you send forms to Bocholt Town Council by post, no other recipients are involved.

Where forms are submitted electronically, the Bocholt City Council uses a service provider. The service provider receives the data mentioned above for this purpose in its capacity as a data processor. The following service providers are involved:

• Zweckverband KAAW as a contractual partner
• bol Behörden Online Systemhaus GmbH as the hosting provider

In connection with administrative procedures that have been initiated, it cannot be ruled out that other bodies may receive your personal data. More detailed information is set out in the information notices for the respective administrative procedure.

d) How long is the data stored?

We delete the personal data we receive via the form as soon as storage is no longer required for the relevant administrative process and the applicable retention obligations. Further details regarding deletion can be found in the relevant information notices for the individual forms.

Personal data accessed via a link (form submission) is stored by the hosting provider for 180 days (IP address, browser used, log files).

e) Information on electronic transmission

We assure you that your personal data will be transmitted using state-of-the-art encryption.

9. Use of local storage items, session storage items and cookies

a) What data is processed and for what purpose?

Our website uses local storage items, session storage items and cookies.

Local storage is a mechanism that enables data to be stored within the browser on your device. This data usually includes user preferences, such as a website's "Day-" or "Night mode", and remains stored until you manually delete it.

Session storage is very similar to local storage, although the data is only stored for the duration of the current session, i.e. until the current tab is closed. After that, the session storage items are deleted from your device.

Cookies are pieces of information that a web server (a server that provides web content) stores on your device in order to identify that device. They are either stored temporarily for the duration of a session (session cookies) and deleted once you have finished visiting a website, or stored permanently (permanent cookies) on your device until you delete them yourself or your web browser deletes them automatically.

These three types of data may also be stored on your device by third-party companies when you visit our site (third-party requests). This enables us, as the operator, and you, as a visitor to this website, to make use of certain services provided by third parties that are integrated into this website. Examples of this include cookies used to process payment services or cookies for displaying videos or maps.

b) On what legal basis is this data processed?

These mechanisms have a wide range of applications. They can improve the functionality of a website, manage shopping basket functions, enhance the security and convenience of using the website, and carry out analyses of visitor traffic and behaviour. Depending on the individual functions, these must be classified in accordance with data protection law. If they are necessary for the operation of the website and intended to provide specific functions (such as the shopping basket function) or serve to optimise the website (e.g. cookies for measuring visitor behaviour), their use is based on Article 6(1)(e) of the GDPR. As the website operator, we have a legitimate interest in storing these cookies to ensure the technically fault-free and optimised provision of our services. In all other cases, cookies are stored only with your explicit consent in accordance with Article 6(1)(a) of the GDPR.

c) Are there any recipients of personal data other than the controller?

Where objects or mechanisms from third-party companies are used, or where they are used for analytical purposes, we will inform you of this separately within this privacy notice. Your required consent will be sought and may be withdrawn at any time.

d) How long is the data stored?

The objects or mechanisms will be deleted once their purpose has been fulfilled. You are responsible for deleting any cookies stored on your device, for example, where you have given your consent.

10. Use of external services (third-party services)

External services are used on our website. External services are services provided by third-party providers that are used on our website. This may be for various reasons, such as embedding videos, maps or recruitment tools, ensuring the security of the website, and much more. When using these services, personal data is also passed on to the respective providers of these external services. If we have no legitimate interest or contractual basis for using these services in accordance with Article 6(b) and (e) of the GDPR, we will obtain your consent - which you may withdraw at any time - as a visitor to our website prior to their use (Article 6(1)(a) of the GDPR).

10.1 Content Management System - EGOTEC AG

a) What data is processed and for what purpose?

A content management system enables the creation, editing, organisation and presentation of digital content. We use a content management system to create content for our website. This enables us to design a more engaging website.

b) On what legal basis is this data processed?

We base this processing on a public interest (Article 6(1)(e) of the GDPR). Our public interest lies in the technically flawless presentation and optimisation of the website.

c) Are there any recipients of the personal data other than the controller?

We use the CMS provided by EGOTEC AG, EGOCMS. The service provider is EGOTEC, Pfalzgraf-Otto-Straße 81, 74821 Mosbach.

As the service is deployed locally on our behalf, there are no further data transfers to third parties with the exception of the hosting provider (see section 5).

d) How long is the data stored?

The data will be deleted as soon as it is no longer required to fulfil the purpose for which it was collected.

10.2 Online appointment bookings

a) What data is processed and for what purpose?

The online appointment booking service is available to you free of charge. Use of the online appointment booking service is personalised. For this purpose, we process personal data (registration details, appointment details) as part of your booking.

b) On what legal basis is this data processed?

If you book an appointment via our website, the provision of personal data is entirely voluntary. The legal basis for the processing is Article 6(1)(a) of the GDPR.

Persons under the age of 16 should not provide us with any personal data unless consent has been given by their parents or legal guardians (Article 8(1) of the GDPR). Consent must then be expressly stated in the message (Article 8(2) of the GDPR)

c) Are there any recipients of the personal data other than the controller?

The City of Bocholt's appointment booking software is hosted by:

JCC SOFTWARE
Zutphenstraat 59
7575 EJ Oldenzaal
Netherlands

The service provider receives the above-mentioned data for this purpose in its capacity as a data processor.

Internally, the relevant specialist department receives your data.

d) How long is the data retained?

We delete any personal data we receive via the appointment booking software as soon as storage is no longer necessary for the purpose for which you provided it.

e) Information on booking appointments

Appointments may only be attended by the person named at the time of booking or by an authorised representative acting on that person's behalf. The name of the person making the booking cannot be changed retrospectively. Transferring an appointment to a third party is not permitted.

The date of birth serves as a verification detail for collecting the local ticket number on the scheduled date.

10.3 Analytics (analytical tools)

a) What data is processed and for what purpose?

We process the personal data of website visitors in order to analyse user behaviour. By analysing the data collected, we are able to compile information on the use of the individual components of our website. This enables us to improve the user-friendliness of our website. Using the analytics tools employed, for example, our website visitors could be recognised on their next visit to our website, and their clicking and scrolling behaviour and their downloads could be measured, page views identified, the duration of their visit or bounce rates measured, and the origin of website visitors (local authority, country, the website from which the visitor came) traced. With the help of these analytics tools, we can improve our market research activities and thus offer you sustainable administrative services.

b) On what legal basis is this data processed?

The processing of the data is based on the legal basis of consent (Article 6(1)(a) of the GDPR). As a website visitor, you have consented to the processing of your personal data by giving your voluntary, explicit and prior consent. Without separate consent, and provided there is no other legal basis within the meaning of Article 6(1) of the GDPR on which we base the processing, we will not process your personal data in the manner described above. We will proceed in the same way if you withdraw your consent. The lawfulness of the processing carried out up to the point of withdrawal remains unaffected.

c) Are there any recipients of the personal data other than the controller?

The recipient(s) depends on the service used. The services we use for the purposes of analysis are described below.

d) How long is the data stored?

The information obtained as part of the analysis is deleted as soon as the purpose has been fulfilled and there is no reason for further processing. You must enquire with the respective third-party service provider regarding how they handle your data.

10.3.1 Matomo

a) What data is processed and for what purpose?

We use the open-source software Matomo to analyse and statistically evaluate the use of the website. Cookies are used for this purpose. The information generated by the cookie regarding website usage is transmitted to our servers and aggregated into pseudonymous usage profiles. The information is used to analyse website usage and to enable us to design our website in line with user needs. The information is not passed on to third parties. Under no circumstances is the IP address linked to other data relating to the user. IP addresses are anonymised so that they cannot be traced back to an individual (IP masking).

b) On what legal basis is this data processed?

The legal basis for the temporary storage of the data is Section 3(1) of the Data Protection Act of North Rhine-Westphalia (DSG NRW) in conjunction with Article 6(1)(a) and (e) of the EU General Data Protection Regulation (GDPR).

c) Are there any recipients of the personal data other than the data controller?

The service provider is InnoCraft Ltd., 150 Willis St, 6011 Wellington,
New Zealand. No information is passed on to third parties through the use of Matamo, as this service is hosted locally.

d) How long is the data stored?

The data will be deleted as soon as it is no longer required for the purpose for which it was collected. Furthermore, it is your responsibility as a user to delete your cookies if necessary. If you delete your cookies, this will result in the opt-out cookie also being deleted, and you may need to deactivate Matomo again.

e) Information on cookies

The service uses the following cookies on our website:

Name: _pk_id.1.164d
Retention period: 393 days
Type: 1st-party
Purpose: This cookie is used to store a unique visitor ID.

10.4 Google services

We use Google services on our website. These services are integrated in a manner that complies with data protection regulations (iFrame and two-click solution). As a visitor, you have the option to proactively activate these services whilst using the website. Should you choose to activate these services, personal data - usually your IP address - will also be processed by Google. We explain below which Google services we have embedded on our website.

10.4.1 Third-party provider: Google Translate

a) What data is processed and for what purpose?

We use the Google Translate service on our website for the purpose of having texts provided by us on our website automatically translated by Google into a language of your choice. When you activate the translation function, personal data is processed. The following data is processed by Google:

• IP address
• Location of access
• Data from the device used to access the website
• Duration and time of visit
• Diagnostic data

Please note: If you use the translation function whilst logged into a Google account, unique identifiers, amongst other things, will be assigned to your user account and processed.

b) On what legal basis is this data processed?

The legal basis for the temporary storage of the data is Section 3(1) of the Data Protection Act of North Rhine-Westphalia (DSG NRW) in conjunction with Article 6(1)(a) of the General Data Protection Regulation (GDPR), based on your consent as soon as you activate the service.

c) Are there any recipients of the personal data other than the data controller?

The data collected is processed exclusively by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. Use of the service may result in data being transferred to a third country (the USA).

d) How long will the data be stored?

Please refer to the general information on data protection here: https://policies.google.com/privacy. Information on how to delete these services can also be found here.

10.5 E-payment (external payment service providers)

a) What data is processed and for what purpose?

We, the Bocholt Municipal Administration, use an online payment service to enable you to make online payments as part of our administrative processes and services. The service is accessed via an external link, but we are providing you with information here regarding data protection in relation to the handling of your personal data.

You have the option to settle contributions, charges, admission fees, taxes, fines, etc. via the administrative procedures we have set up in connection with the relevant levies.

We collect personal data from you in two different ways as part of the e-payment process:

1. When you visit the website of our online payment service, we collect personal data via log data (further information can be found in section two of this privacy policy).

2. Personal data is collected when you use the selected online payment process. The data - accounting records - is processed automatically in our financial accounting system. This includes all information relating to your payment transaction.

We process the aforementioned data for the following purposes:

• Processing administrative procedures associated with a payment
• The data is collected for the purpose of forwarding it to a payment service provider, which carries out the actual payment transaction with the user. As a rule, the following data is processed here: application, surname, first name, the administrative procedure used for the accounting entry and its URL, and one or more monetary amounts. Additional data included in the calling application/procedure may also be processed (e.g. vehicle registration number in the case of administrative offences).

b) On what legal basis is this data processed?

The legal basis for the temporary processing of the data is Section 3(1) of the Data Protection Act of North Rhine-Westphalia (DSG NRW) in conjunction with Article 6(1)(a) and (e) of the General Data Protection Regulation (GDPR) and your chosen payment method.

c) Are there any recipients of the personal data other than the data controller?

In the case of an electronic payment, Bocholt Municipal Council uses a service provider (a data processor for the software) as well as other payment service providers. In this context, the categories of recipients receive only the information for which they are responsible. The following categories of recipients are involved:

• Zweckverband KAAW as a contractual partner
• GovConnect GmbH as the software provider (payment platform)
• ITEBO GmbH as the hosting provider
• Payment service providers responsible for processing the payment, such as
• PayPal
• Paydirekt
• Sofortüberweisung
• Credit card payment
• Direct debit
• Giropay
• Please note: Please refer to the privacy policy of your chosen service provider.

d) How long is the data stored?

We store the data generated during the payment process in connection with the associated administrative procedures and the applicable retention obligations. This period is ten years.

e) Information on selecting your online payment service

By using the relevant online payment service, you, as the user, agree to be bound by its terms and conditions. The Bocholt Municipal Administration has no influence over these terms and conditions. Once data has been entered and "submitted" to the payment service provider with a click of the mouse, it can no longer be withdrawn or deleted by the service provider. Once the data has been processed by the connected payment service provider, it is retained and stored by the service provider for statistical purposes. It is then automatically deleted. Furthermore, the data is generated, stored and transmitted for the purpose of creating and sending accounting entries to the Bocholt City Council. There, it is stored for at least ten years. It is not possible to delete the data from the financial systems. The data may be transferred to servers abroad if the selected payment service provider operates servers abroad. The service provider has no control over this.

All connections are SSL/TLS-encrypted. This ensures that all data is transmitted securely between the parties involved, in accordance with the current state of the art. However, the actual level of encryption also depends on the web browser used.

10.6 Booking platform (anny)

a) What data is processed and for what purpose?

Content from booking platforms is embedded on our website. These may provide information, contain advertising or even enable the booking of services or other offers. In addition to technical data such as the IP address, the data you provide is transmitted to the provider.

b) On what legal basis is this data processed?

Processing only takes place if you consent to this data processing (via our consent banner on the website). The legal basis for this processing is consent (Article 6(1)(a) of the GDPR). Without your consent, data processing in the manner described above will not take place. If you withdraw your consent (e.g. via the consent banner or other options provided on this website), we will cease this data processing. The lawfulness of the processing carried out up to the point of withdrawal remains unaffected.

c) Are there any recipients of the personal data other than the data controller?

The Bocholt Municipal Authority uses a service provider for the booking platform provided. The service provider is:

anny GmbH
Cäcilienstraße 30
50667 Cologne

Tel.: 0241 93688158

https://anny.co/

anny GmbH collects and processes personal data on behalf of others in its capacity as a data processor. The hosting and operation of our website take place within the European Economic Area.

In the course of using the application, access to personal data is granted to those employees who require it to carry out their duties.

d) How long is the data stored?

The data will be deleted as soon as it is no longer required to fulfil the purpose for which it was collected.

e) Information on cookies

The service uses the following cookies on our website:

Name: _i18n_redirected

Retention period: 365 days

Type: third-party cookie, anny.co

Purpose: This cookie is used to redirect users to their preferred website.

10.7 Content Delivery Network (CDN)

a) What data is processed and for what purpose?

We use a Content Delivery Network (CDN) to optimise the performance and availability of our website. To this end, the service provider that makes this network available processes your IP address and information about when you visited our website. Further information on data processing by this service provider can be found in its privacy policy.

b) On what legal basis is this data processed?

We base this processing on a public and legitimate interest (Article 6(1)(e) and (f) of the GDPR). Our public and legitimate interest lies in being able to present our website to you as quickly, securely and reliably as possible.

c) Are there any recipients of the personal data other than the controller?

c.1) Bootstrap CDN

We use the Bootstrap CDN service on our website. The service provider is Prospect One Ltd., Królewska 65A/1, PL-30-081 Kraków, Poland.

Use of the service may result in data being transferred to a third country (the USA).

Bootstrap CDN is a content delivery network that mirrors our content across various servers to ensure optimal global accessibility

Further information can be found in the provider's privacy policy at the following URL: https://www.jsdelivr.com/terms/privacy-policy-jsdelivr-net

c.2) CloudFlare

We use the CloudFlare service on our website. The service is provided by Cloudflare Germany GmbH, Rosental 7, 80331 Munich, Germany.

Use of the service may result in data being transferred to a third country (the USA). The provider is certified under the EU-US Data Privacy Framework and therefore offers an adequate level of data protection.

Cloudflare is a so-called Content Delivery Network, which, in addition to distributing the website across multiple servers, also provides security functions. Furthermore, Cloudflare acts as a reverse proxy for our website.

Further information can be found in the provider's privacy policy at the following URL: https://www.cloudflare.com/privacypolicy/.

d) How long is the data stored?

The data is deleted as soon as it is no longer required to fulfil the purpose for which it was collected.

10.8 Map services (ArcGIS, OpenStreetMap)

a) What data is processed and for what purpose?

We use a map service on this website. In order for the map to be used and displayed on the website, it must be loaded from the provider's server. This involves the transmission of your IP address to the provider's server. Depending on the provider, cookies and other technologies, including fonts, may be loaded. Further details can be found in the provider's privacy policy.

b) On what legal basis is this data processed?

Data will only be processed if you consent to this data processing (via our consent banner on the website). The legal basis for this processing is consent (Article 6(1)(a) of the GDPR). Without your consent, data processing in the manner described above will not take place. If you withdraw your consent (e.g. via the consent banner or other options provided on this website), we will cease this data processing. The lawfulness of the processing carried out up to the point of withdrawal remains unaffected.

c) Are there any recipients of the personal data other than the controller?

C1) ArcGIS

We use the ArcGIS service on our website. The service is provided by Environmental Systems Research Institute, Inc., 380 New York Street, Redlands, CA 92373, USA.

Use of the service may result in data being transferred to a third country (the USA).

Further information can be found in the provider's privacy policy at the following URL: https://www.esri.com/en-us/privacy/privacy-statements/privacy-statement.

C2) OpenStreetMap

We use the OpenStreetMap service on our website. The service provider is the OpenStreetMap Foundation, St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom.

Use of the service may result in data being transferred to a third country (the UK). The European Commission has confirmed, by means of an adequacy decision, that the country offers an adequate level of data protection.

Further information can be found in the provider's privacy policy at the following URL: https://wiki.osmfoundation.org/wiki/Privacy_Policy.

d) How long is the data stored?

The data will be deleted as soon as it is no longer required to fulfil the purpose for which it was collected.

10.9 Software framework

a) What data is processed and for what purpose?

Software frameworks facilitate interaction with a platform by providing a standardised interface to it. Frameworks are used to reduce the development effort involved in meeting recurring software requirements and to ensure the reusability of code and functions. Some software frameworks implement security features to prevent misuse of the website. Software frameworks can enhance functionality, accessibility, security and performance with minimal effort. Other areas of application can also be covered by software frameworks.

b) On what legal basis is this data processed?

Processing only takes place if you consent to this data processing (via our consent banner on the website). The legal basis for this processing is consent (Article 6(1)(a) of the GDPR). Without your consent, data processing as described above will not take place. If you withdraw your consent (e.g. via the consent banner or other options provided on this website), we will cease this data processing. The lawfulness of the processing carried out up to the point of withdrawal remains unaffected.

c) Are there any recipients of the personal data other than the controller?

jQuery

We use the jQuery service on our website. The service is provided by the OpenJS Foundation, 1 Letterman Dr, Ste D4700, San Francisco, California, 94129, USA.

Use of the service may result in data being transferred to a third country (the USA).

Further information can be found in the provider's privacy policy at the following URL: https://openjsf.org/wp-content/uploads/sites/84/2021/04/OpenJS-Foundation-Privacy-Policy-2019-11-15.pdf.

d) How long is the data stored?

The data will be deleted as soon as it is no longer required to fulfil the purpose for which it was collected.

11. Social media

The City of Bocholt provides links only to its social media profiles, such as Facebook, Instagram, X (formerly: Twitter), WhatsApp, YouTube, etc. You can recognise these links by the respective social network logo.

The purpose of our profiles on social media platforms is to expand our online presence and thereby increase our visibility, as well as to provide (press) information. Therefore, the legal basis to be applied is legitimate interest in accordance with Article 6(1)(e) of the GDPR. Furthermore, with regard to the processing activities carried out by the social networks, reference must be made to their own legal bases (e.g. consent in accordance with Article 6(1)(a) of the GDPR), which you can find in the respective privacy policy.

The City of Bocholt does not use any so-called social media plugins on its website. External pages of social networks are only accessed when you actively use the links. If you do not wish social networks to associate data collected via our website with your user account, you must log out of the social network before visiting our website. Please refer to the privacy policies of the respective providers for information on the purpose and scope of data collection, as well as the further processing and use of data by social networks, and your rights and settings options regarding the protection of your privacy.

What does it mean for you as a user when you connect with us via social media? When you visit our profiles, your IP address and other information about the devices you use are processed, amongst other things, which enables IP addresses to be linked to individual users. We have no control over this data processing. Please note that you use our profiles on social media platforms and their features at your own risk. Details regarding data processing can be found in the operator's privacy policy.

We would like to reiterate at this point that you use the services we offer and their features at your own risk. This applies in particular to interactive features such as sharing, rating, commenting, etc.

Additional information on social networks

Social media platforms process their users' personal data on a large scale. The following information outlines the data protection aspects relating to the social media profiles and platforms operated by the City of Bocholt.

a) What data is processed and for what purposes?

In addition to other media channels - in particular the town's website - the Town of Bocholt maintains an online presence on social media networks and platforms in order to provide information to citizens, interested parties and users active on these platforms as part of its public relations work. Citizens, users and interested parties therefore have various options available to them for finding out about the City of Bocholt and getting in touch with it.

b) On what legal basis is this data processed?

The City of Bocholt uses social media for targeted public relations work with citizens. The associated processing of users' personal data is justified under Article 6(1)(e) of the GDPR in conjunction with Section 3(1) of the North Rhine-Westphalia Data Protection Act. The provision of effective information to citizens by public authorities serves the performance of a task carried out in the public interest. Furthermore, users are generally asked by the respective platform providers to give their consent to the data processing described above in accordance with Article 6(1)(a) of the GDPR.

c) Information on data processing on social media platforms

We would like to point out that when using social networks, users' data may be processed outside the European Union. It is not known exactly which data is collected or for what purposes it is processed. However, it is certain that users' IP addresses, as well as other data or information stored on your device in the form of cookies, are collected and processed. We have no control over this data processing. The transfer of data outside the European Union may entail risks for users, as it could, for example, make it more difficult to enforce users' rights, particularly in the US.

Furthermore, users' data may be processed by the providers for market research and advertising purposes. For example, usage profiles are created based on users' behaviour and the resulting interests. These user profiles may be used by the providers, for example, to display advertisements both on and off the platforms that are presumed to correspond to the users' interests. For these purposes, cookies are usually stored on users' computers, in which users' usage behaviour and interests are recorded. Furthermore, data may also be stored in the usage profiles regardless of the devices used by users (in particular where users are members of the respective platforms and are logged in to them).

In principle, we are jointly responsible with the relevant social media platform for the data processing operations triggered when you visit our profile. You may therefore exercise your data subject rights under Article 15 et seq. of the GDPR both vis-à-vis the social media platform and vis-à-vis us. However, for a detailed description of the respective processing activities and the options for objecting (opt-out), please refer to the information provided by the providers via the links below. We would also like to point out that, in the case of requests for information and the exercise of user rights, these can most effectively be exercised with the providers themselves. Only the providers have access to users' data and can take appropriate action and provide information directly. Should you nevertheless require assistance, you may contact us.

1. Facebook:

We have a profile on Facebook. The controller responsible for the processing of personal data is

Bocholt Town Council
The Mayor
Kaiser-Wilhelm-Str. 52-58
46395 Bocholt

Tel.: 02871/953-0
Email: https://www.bocholt.de

as well as

Meta Platforms Ireland Ltd.
4 Grand Canal Square
Grand Canal Harbour
Dublin 2, Ireland
https://www.facebook.com

as joint controllers in accordance with Article 26 of the GDPR and the Facebook Page Insights Supplement: https://www.facebook.com/legal/terms/page_controller_addendum

The City of Bocholt's Facebook page (https://www.facebook.com/stadt.bocholt) publishes up-to-date information from our region, as well as campaigns, initiatives, events and news relating to the city of Bocholt. When you visit our fan page, personal data is stored and processed by Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, D2 Dublin, Ireland, as the provider of Facebook, in accordance with Facebook's privacy policy. Detailed information on the handling of personal data can be found in Facebook's privacy policy at: https://www.facebook.com/privacy/policy/.

Furthermore, we only process data to a very limited extent:

When users comment on, share or otherwise interact with any of the posts on our Facebook fan page, the City of Bocholt processes personal data. This includes the relevant Facebook user data (in particular, username, profile URL and profile picture), the content of the comments posted by users and the associated metadata (in particular, the time at which users posted the relevant comment).

Meta Platforms Ireland Limited provides us with statistics and usage data via the Facebook social media platform, which we can use to analyse the usage of our Facebook fan page - known as "Page Insights". As the page operator, we do not make any decisions regarding the processing of Insights data or any other information arising from Article 13 of the GDPR, such as the storage period of cookies on users' end devices. The primary responsibility under the GDPR for the processing of Insights data lies with Meta Platforms Ireland Limited. As page operators, we have no other means - not even via user tracking - of analysing user behaviour on our Facebook fan page. Nor is it generally possible for us to identify visitors to our Facebook fan page on the basis of Page Insights. In particular, under the terms of the agreement, we have no right to request that Meta Platforms Ireland Limited disclose individual user data. We can only identify users if we are able to match individual profile pictures with "Like" details for the page; but this is only possible if visitors have marked our Facebook fan page with a "Like" and the "Like" has been set to "public%$. The City of Bocholt can use Page Insights to carry out an anonymous analysis of reach, page views, the time spent watching video posts, user interactions (likes, comments, sharing posts), as well as by age, gender and location (as specified by users in their respective Facebook profiles). For the analysis of reach, settings can be adjusted or appropriate filters applied with regard to selecting a time period, analysing a specific post, and demographic groupings (e.g. female, aged 20-30). This data is anonymised, aggregated and abstracted. These settings therefore do not allow the City of Bocholt to draw any conclusions about individuals. The analysis serves to optimise the content on the City of Bocholt's Facebook page for public relations purposes.

You can read about the information Facebook uses to generate Page Insights here:https://www.facebook.com/legal/terms/information_about_page_insights_data

On Facebook, you also have the option to customise your advertising preferences using the opt-out procedure:

https://www.facebook.com/adpreferences/ad_settings/?entry_product=account_settings_menu

· The following aggregated and non-personally identifiable data is provided via the "Page Insights" of the City of Bocholt as the page operator:

· Actions on the page (including website clicks, button clicks, etc.)

· Page views (including by age, gender and country)

· "Likes" for the page (page growth)

· Post reach

· Reach of Facebook Stories - post interactions - video views

· Page followers (including source of new followers)

· People (aggregated data, including by gender, age, country, city and language)

The City of Bocholt, as the provider of the information service, does not collect or process any further data relating to the use of the Facebook page.

Users' data remains accessible to the City of Bocholt via our Facebook fan page until the user's account, or just the relevant data itself - such as an individual comment - is deleted. Furthermore, the City of Bocholt may store the above-mentioned data where and for as long as this is necessary for legal proceedings or to comply with retention obligations.

Users' rights vis-à-vis the City of Bocholt regarding the processing of personal data can be found under the heading 2 "Your rights as a user" in this privacy policy.

Data collected via the social media platform is shared and processed within Meta Platforms Ireland Limited. Meta Platforms Ireland Limited also includes, amongst others, Instagram, WhatsApp and Oculus. For example, information collected via Facebook is used to display personalised adverts to users on Instagram, or information from WhatsApp is used to take action on Facebook against accounts that send spam via WhatsApp. You can find this information in the Facebook Privacy Policy ( https://www.facebook.com/privacy/policy/ ) under "How do Facebook companies work together?". When data is processed by Meta Platforms Ireland Limited, user data may be transferred outside the European Economic Area (EEA), in particular to the USA.

Right to object: Where personal data is processed on the basis of legitimate interests pursuant to Article 6(1)(f) of the GDPR, users have the right to object to the processing of their personal data in accordance with Article 21 of the GDPR. Provided that Meta Platforms Ireland Limited has no compelling legitimate grounds for processing the user information which override the interests, fundamental rights and freedoms of the users concerned, or if the processing is not required for legal reasons, the objection will be upheld and Meta Platforms Ireland Limited will cease processing the relevant user information. The options for managing user information and lodging an objection are set out in the network operator's help section: https://www.facebook.com/help/contact/367438723733209

Breaches of personal data protection in connection with joint processing, Articles 33 and 34 of the GDPR: Where a breach of personal data protection relates to the obligations of Meta Platforms Ireland Limited under the Supplement for Controllers, users may lodge a complaint with the lead supervisory authority responsible for Meta Platforms Ireland Limited, the Irish Data Protection Commission, or with the user's local supervisory authority.

2. Instagram:

We have a profile on Instagram. The controller responsible for the processing of personal data is

Bocholt Town Council
The Mayor
Kaiser-Wilhelm-Str. 52-58
46395 Bocholt

Tel.: 02871/953-0
Email: https://www.bocholt.de

as well as

Meta Platforms Ireland Ltd.
4 Grand Canal Square
Grand Canal Harbour
Dublin 2, Ireland
https://www.instagram.com/

as joint controllers in accordance with Article 26 of the GDPR.

The 'Stadt Bocholt' Instagram channel publishes information about our region, as well as campaigns, initiatives, events and news relating to the town of Bocholt. Cross-media [MK1] content is also published. When you visit our channel, personal data is stored and processed by Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, D2 Dublin, Ireland, as the provider of Instagram, in accordance with Instagram's Privacy Policy. You can find the Privacy Policy here: https://privacycenter.instagram.com/policy/

Furthermore, we only process data to a very limited extent:

For the purpose of tailoring our pages to user needs and continuously optimising them, we use the analytics service Instagram Insights. This service tracks your activity on our page and provides us with anonymised statistics. This provides us with insights into, amongst other things, the interactions of visitors to our fan page, the number of page views, the reach of posts, information about the activity of our followers, as well as information on the countries and cities our visitors come from, and statistics on the gender distribution of our visitors. It is not possible to identify individual users or for the administrator to access individual user profiles. Furthermore, we store usernames and comments that are deleted due to breaches of netiquette. These are retained solely for the purpose of providing evidence, if necessary, in the event of legal disputes within the limitation period. Apart from this, we do not, as a matter of principle, store or process any of your personal data. After making a public and non-binding request, we publicly ask users for permission to repost their images on the 'Stadt Bocholt' Instagram channel . We store the declaration of consent as a screenshot and the image as a file, along with the user's details. The photos and the declaration of consent are stored for as long as the photo remains posted on the channel or until consent is withdrawn. [MK2] For technical reasons, the reposted photo is stored on Instagram's server [Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, D2 Dublin, Ireland]. Consent may be withdrawn at any time (for further details, see: Rights of the data subject). In the event of withdrawal, the image and the user's details will be deleted immediately.

3. Threads on the Instagram app:

We have a Threads profile on Instagram. The controller responsible for the processing of personal data is

Bocholt Town Council
The Mayor
Kaiser-Wilhelm-Str. 52-58
46395 Bocholt

Tel.: 02871/953-0
Email: https://www.bocholt.de

as well as

Meta Platforms Ireland Ltd.
4 Grand Canal Square
Grand Canal Harbour
Dublin 2, Ireland
https://www.instagram.com/

as joint controllers in accordance with Article 26 of the GDPR.

The @stadt.bocholt Threads channel is used for press and public relations work on all matters relating to the town of Bocholt.

When you visit our fan page, personal data is stored and processed by Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, D2 Dublin, Ireland, as the provider of Instagram, in accordance with Instagram's privacy policy. You can find the privacy policy here:

https://help.instagram.com/515230437301944/?helpref=uf_share

In addition, we store usernames and comments that are deleted due to breaches of netiquette. These are retained solely for the purpose of providing evidence, where necessary, in the event of legal disputes within the limitation period. Apart from this, we do not, as a matter of principle, store or process any of your personal data.

4. YouTube:

We have a profile on YouTube. The controller responsible for the processing of personal data is

Bocholt Town Council
The Mayor
Kaiser-Wilhelm-Str. 52-58
46395 Bocholt

Tel.: 02871/953-0
Email: https://www.bocholt.de

as well as

Google LLC
Amphitheatre Parkway
Mountain View
CA 94043, USA
https:// www.youtube.com/

as joint controllers in accordance with Article 26 of the GDPR.

The City of Bocholt's YouTube channel ( https://www.youtube.com/@stadt.bocholt ) enables the publication of video content relating to press events, events and services offered by the City of Bocholt. The videos are tailored to the target audience, report on the latest news from the City of Bocholt and help to showcase the diversity of topics within the city. On YouTube, too, the social media team professionally addresses and responds to users' questions and comments.

When you visit YouTube, Google LLC ("Google"), Amphitheatre Parkway, Mountain View, CA 94043, USA, as the operator of YouTube, stores and processes personal data in accordance with Google's Privacy Policy. You can find the privacy policy here: https://policies.google.com/privacy?hl=de&gl=de

Furthermore, we only process data to a very limited extent. In the event of a breach of netiquette, we store usernames and any comments that are deleted due to a breach of netiquette. These are retained solely for the purpose of providing evidence, where necessary, in the event of legal disputes within the limitation period.

5. X (formerly Twitter):

We have a profile on X. The controller responsible for the processing of personal data is

Bocholt Town Council
The Mayor
Kaiser-Wilhelm-Str. 52-58
46395 Bocholt

Tel.: 02871/953-0
Email: https://www.bocholt.de

and

Twitter Inc.
1355 Market Street
Suite 900
San Francisco
CA 94103, USA
https://twitter.com

as joint controllers in accordance with Article 26 of the GDPR.

The X channel @StadtBocholt is used for press and public relations work on all matters relating to the town of Bocholt.

When you visit our channel, Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA, as the operator of Twitter, stores and processes personal data to the extent described in the privacy policy. You can find the Privacy Policy here: https://twitter.com/de/privacy

Apart from this, we do not, as a rule, store or process any of your personal data. Your username is only stored if you send us a direct message. We also store usernames and comments that are deleted due to breaches of netiquette. These are retained solely for the purpose of providing evidence, where necessary, in the event of legal disputes, for the duration of the limitation period.

6. LinkedIn:

We have a profile on LinkedIn. The parties responsible for the processing of personal data are

and

LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.
https://de.linkedin.com/

as joint controllers in accordance with Article 26 of the GDPR.

The City of Bocholt's LinkedIn channel ( https://www.linkedin.com/company/stadt-bocholt/ ) is used for press and public relations work on all matters relating to the City of Bocholt.

When you visit our LinkedIn account, LinkedIn, as the operator, stores and processes personal data to the extent described in its privacy policy. You can find the privacy policy here: https://de.linkedin.com/legal/privacy-policy?_l=de_DE

When you visit our official LinkedIn page, follow this page or engage with it, LinkedIn processes personal data to provide us with statistics and insights in an anonymised form. This gives us an understanding of the types of actions people take on our page (known as 'Page Insights'). To this end, LinkedIn processes, in particular, data that you have already provided to LinkedIn via the information in your profile, such as data on your role, country, sector, length of service, company size and employment status. In addition, LinkedIn will process information about how you interact with our LinkedIn organisation page, e.g. whether you are a follower of our LinkedIn organisation page. LinkedIn does not provide us with any of your personal data via Page Insights. We only have access to the aggregated Page Insights. Nor is it possible for us to draw conclusions about individual members based on the information in Page Insights. We therefore do not, as a matter of principle, store or process any personal data relating to you. Only in the event that you send us a direct message will we store your username and, where applicable, the content of the message. We also store usernames and text content that are deleted due to breaches of netiquette. These are retained solely for the purpose of providing evidence, should it be required in legal disputes, within the limitation period.

We have entered into an agreement with LinkedIn regarding processing as joint controllers, which sets out the allocation of data protection obligations between us and LinkedIn. The agreement is available at:

https://de.linkedin.com/legal/l/dpa

LinkedIn offers the option to object to certain data processing activities; information on this and opt-out options can be found at:

https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out

7. WhatsApp

We have a profile (channel) on WhatsApp. The service provider is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

Detailed information on the handling of personal data can be found in WhatsApp's privacy policy below: https://www.whatsapp.com/legal/privacy-policy-eea?lang=de

Meta Platforms also transfers and processes data in the USA. At present, there is no adequate level of protection for data transfers to the USA. For this reason, there are risks associated with the processing of data. Meta Platforms uses standard contractual clauses and is part of the Data Privacy Framework, through which Meta Platforms undertakes to ensure an adequate level of data protection.

12. Chatbot "Digital Citizen Assistant"

On our website, we use an AI-based chatbot to answer your enquiries and optimise our citizen services. This is hosted by YOUniquehorns GmbH, based in Ulm, Germany ("BotBucket").

Your chat history (questions/answers) and your IP address are stored by our IT service provider for a maximum of three months and are then automatically deleted. Only anonymised information relating to usage statistics for the chatbot as a whole is retained.

"BotBucket" is operated in the AWS and Azure clouds. The server locations are within the EU. Enquiries entered may also be processed by Google outside the EU (search). By using the chatbot on our website, you expressly consent to this processing. At no point does the chatbot require any information about you as the user.

Please therefore ensure that, when using the chat, you do not enter any details about yourself or other people - such as names, email addresses, telephone numbers, etc. - into the chat window.

13. Online appointment bookings

The online appointment booking service is available to you free of charge. Use of the online appointment booking service is personalised. For this purpose, we process personal data (registration details, appointment details) as part of your booking.

Further information on online appointment booking

a) On what legal basis is this data processed?

If you book an appointment via our website, the provision of personal data is entirely voluntary. The legal basis for the processing is Article 6(1)(a) of the GDPR.

Persons under the age of 16 should not provide us with any personal data unless consent has been given by their parents or legal guardians (Article 8(1) of the GDPR). Consent must then be explicitly stated in the message (Article 8(2) of the GDPR).

b) Are there any recipients of the personal data other than the controller?

The City of Bocholt's appointment software is hosted by:

SMART CJM GmbH, Heyenbaumstr. 139-141, 47802 Krefeld, Germany

The service provider receives the above-mentioned data for this purpose in its capacity as a data processor. Internally, the relevant departmental office receives your data.

c) How long will the data be stored?

We delete any personal data we receive via the appointment booking software as soon as storage is no longer necessary for the purpose for which you provided it.

Information on appointment bookings

Appointments may only be attended by the person named at the time of booking or by an authorised representative acting on that person's behalf. The name of the person making the booking cannot be changed retrospectively. Transferring an appointment to a third party is not permitted.