1. Data Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) and other applicable data protection legislation is:
IOB – Internationale Organisation für naturnahe Badegewässer e. V.
International Organization for Natural Bathing Waters
Überseetor 14
28217 Bremen
Germany
Authorised representative of the Executive Board: Stefan Meier
Managing Director: Anja Börm
Phone: +49 421 178 76 279
Email: office@iob-ev.com
Website: https://iob-ev.com
2. General Information on Data Processing
We take the protection of your personal data seriously. Personal data means any information relating to an identified or identifiable natural person.
We process personal data only to the extent necessary to provide a functional and secure website, communicate with visitors, members, interested parties and business partners, fulfil our statutory and contractual duties, or where you have given your consent to the processing.
Depending on the respective purpose, personal data is processed in particular on the basis of Art. 6(1)(a), (b), (c) or (f) GDPR.
3. Hosting
This website is hosted by:
Hetzner Online GmbH
Industriestr. 25
91710 Gunzenhausen
Germany
When you access our website, the hosting provider processes technically necessary data. This may include, in particular, your IP address, date and time of access, the page or file requested, referrer URL, amount of data transferred, browser type and version, and the operating system used.
The processing is carried out to ensure the secure, stable and technically reliable operation of our website on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and efficient provision of our online services.
Where the hosting provider processes personal data on our behalf, this is carried out on the basis of a data processing agreement pursuant to Art. 28 GDPR.
4. Server Log Files
When you visit our website, information may automatically be stored in server log files. This information may include, in particular:
- IP address of the accessing device,
- date and time of access,
- pages and files accessed,
- referrer URL,
- browser type and browser version,
- operating system used, and
- hostname of the accessing device.
This data is processed in particular to ensure the trouble-free operation of the website, to analyse technical errors and to detect and prevent abusive or security-related access.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the security, stability and functionality of our website.
Server log files are retained only for as long as necessary for the purposes described above. They may be retained for a longer period where this is necessary to investigate specific security incidents or where statutory retention obligations apply.
5. SSL/TLS Encryption
For security reasons and to protect the transmission of confidential information, this website uses SSL or TLS encryption.
You can recognise an encrypted connection, in particular, by the fact that the address bar of your browser begins with “https://”.
6. Cookies and Similar Technologies
Our website uses cookies and comparable technologies. Cookies are small files or units of information that can be stored on or read from your device.
Technically necessary cookies and comparable technologies are used where they are required to provide the website or a function expressly requested by you.
The storage of information on your device or access to information already stored on your device in connection with technically necessary technologies is based on Section 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG).
Where cookies or comparable technologies are not technically necessary, they are generally used only after you have given your prior consent pursuant to Section 25(1) TDDDG. Where personal data is processed in this context, the processing is based on your consent pursuant to Art. 6(1)(a) GDPR.
You may withdraw your consent at any time with effect for the future or change your preferences via the cookie settings provided on our website.
7. Consent Management with Complianz
We use Complianz on this website to obtain, manage and document your consent to the use of cookies and comparable technologies.
Information about your consent decision is stored so that your preferences can be taken into account during subsequent visits and so that evidence of consent or refusal can be maintained where required.
The processing is carried out to comply with our legal obligations pursuant to Art. 6(1)(c) GDPR and, where applicable, on the basis of our legitimate interest in providing legally compliant and user-friendly consent management pursuant to Art. 6(1)(f) GDPR.
You can change your preferences or withdraw your consent at any time with effect for the future via the cookie settings provided on our website.
8. Cookie Policy
Detailed and up-to-date information about the cookies and comparable technologies used on our website, their purposes, storage periods and providers can be found in our separate Cookie Policy and within the cookie settings.
The Cookie Policy is provided through our consent management system and is displayed according to the language selected on the website.
9. Multilingual Website with qTranslate-XT
Our website uses qTranslate-XT to provide content in different languages.
As part of the language selection process, technically necessary information may be stored so that the language you select can be retained during subsequent page views.
Where information is stored on or read from your device for this purpose and this is necessary to provide the language version you have selected, this is carried out on the basis of Section 25(2) TDDDG.
Any associated processing of personal data is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in providing a user-friendly, multilingual website.
10. Contact Forms
Our website provides various contact forms that allow you to contact us electronically.
When you use a contact form, we process the information you enter into the respective form. Depending on the form, this may include, in particular:
- your name,
- email address,
- company or organisation,
- telephone number,
- subject and content of your message, and
- any other information you voluntarily provide.
The specific personal data processed depends on the contact form you use.
If your enquiry relates to the initiation or performance of a contractual relationship, the processing is based on Art. 6(1)(b) GDPR.
In other cases, processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in efficiently processing and responding to enquiries addressed to us.
Where you have expressly consented to a particular type of processing, the processing is based on Art. 6(1)(a) GDPR.
Data submitted through a contact form will generally be deleted once your enquiry and any subsequent communication have been completed, unless statutory retention obligations or other legal grounds require or permit further storage.
11. Google reCAPTCHA
We use Google reCAPTCHA to protect our contact forms and our website against automated access, spam and misuse.
The provider within the European Economic Area is:
Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland
When reCAPTCHA is used, technical information may be transmitted to and processed by Google. Depending on the specific implementation, this may include, in particular, your IP address, browser and device information, operating system, referrer URL, date and time of access, interactions with the website and other technical information required to assess whether an interaction originates from a human user or an automated system.
When reCAPTCHA is used, additional Google resources may also be loaded. These may technically include resources associated with Google Fonts.
The fonts used for the general design of our website are hosted locally on our server. Therefore, no connection to Google Fonts is generally required for the display of the website itself. However, in connection with the external Google reCAPTCHA service, Google resources may be loaded and connections to Google servers may be established.
Where reCAPTCHA involves storing information on or accessing information from your device and this is not strictly necessary, this is carried out on the basis of your consent pursuant to Section 25(1) TDDDG. The associated processing of personal data is based on your consent pursuant to Art. 6(1)(a) GDPR.
You may withdraw your consent at any time with effect for the future via our cookie settings.
In connection with the use of Google services, personal data may also be processed by Google LLC or other Google companies outside the European Economic Area. Any transfer of personal data to third countries is carried out in accordance with the requirements of Art. 44 et seq. GDPR.
Further information about Google’s processing of personal data can be found in Google’s privacy information.
12. Locally Hosted Fonts
The fonts used for the general presentation of our website are hosted locally on our server.
During a normal visit to our website, no connection to servers of external font providers is therefore required for the provision of these locally hosted fonts.
Irrespective of this, resources from external providers may be loaded in connection with external services that we expressly use, in particular Google reCAPTCHA. Further information can be found in the relevant sections of this Privacy Policy.
13. External Content and Services
Our website may include content or services provided by external providers, such as social media content, videos, maps or other external media.
Where such integration is not technically necessary and involves storing or accessing information on your device or transferring personal data to the respective provider, the content or service is generally activated only after you have given your consent.
In such cases, the legal basis for storing or accessing information on your device is Section 25(1) TDDDG. The legal basis for the associated processing of personal data is Art. 6(1)(a) GDPR.
The specific services and providers used on our website are listed, where applicable, in our Cookie Policy and within the cookie settings.
14. Social Media Content
Our website may include or link to content from social networks, in particular Instagram.
Where our website merely provides a link to an external social media service, data is generally transferred to the respective provider only when you follow the relevant link.
Where social media content is embedded directly into our website and establishing a connection to the respective provider requires consent, such content is generally loaded only after you have given the corresponding consent.
After external social media content has been activated, your IP address as well as browser, device and usage information may be transmitted to the respective provider. If you are simultaneously logged into the relevant social network, the provider may be able to associate your visit to our website with your user account.
Consent-based social media content is activated on the basis of Section 25(1) TDDDG and Art. 6(1)(a) GDPR.
Further information about the specific services and cookies detected on our website can be found in our Cookie Policy and cookie settings.
15. Contact by Email and Telephone
If you contact us by email, telephone or other means, we process the personal data you provide in order to respond to your enquiry and any subsequent questions.
If your enquiry relates to the initiation or performance of a contractual relationship, the processing is based on Art. 6(1)(b) GDPR.
In other cases, processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in appropriately processing and responding to enquiries addressed to us.
Where you have expressly consented to a particular type of processing, the processing is based on Art. 6(1)(a) GDPR.
Data received in connection with an enquiry will be deleted once the purpose of the processing no longer applies, provided that no statutory retention obligations or other legal grounds require or permit further storage.
16. Communication with Members, Interested Parties and Business Partners
As part of our association activities and our cooperation with members, interested parties, partner organisations, service providers and other business partners, we process personal data where this is necessary for communication, administration and management of the respective relationship.
This data may include, in particular, names, organisations, positions or functions, addresses, telephone numbers, email addresses, as well as communication and contractual data.
Depending on the respective relationship, processing is carried out in particular on the basis of Art. 6(1)(b) or (f) GDPR.
Our legitimate interest lies, in particular, in carrying out our association activities and in ensuring efficient communication and cooperation with members, interested parties and business partners.
17. Recipients of Personal Data
Personal data is generally made available only to those internal departments and external recipients that require the data to perform the respective tasks.
These recipients may include, in particular, hosting and IT service providers, technical service providers, providers of the online services we use, tax advisers and other contractual partners, insofar as their involvement is necessary for the respective purpose.
Where external service providers process personal data on our behalf, we conclude a data processing agreement pursuant to Art. 28 GDPR where required by law.
18. Transfers of Personal Data to Third Countries
When certain external services are used, personal data may be transferred to recipients outside the European Union or the European Economic Area.
Such transfers are made only in compliance with the requirements of Art. 44 et seq. GDPR. This may include, in particular, transfers based on an adequacy decision by the European Commission or appropriate safeguards such as the European Commission’s Standard Contractual Clauses.
Where a provider is certified under an adequacy mechanism recognised by the European Commission, a transfer may be based on the corresponding adequacy decision.
Where the use of an external service depends on your consent, the relevant processing will generally take place only after you have given that consent.
19. Data Retention
We generally store personal data only for as long as necessary to fulfil the respective purpose of the processing.
Where statutory retention obligations apply, the relevant data is stored for the duration of the applicable statutory retention period and is subsequently deleted unless another legal basis requires or permits further storage.
Where processing is based on your consent, the relevant data is generally processed until you withdraw your consent, unless another legal basis permits or requires continued processing.
Different storage periods may apply to individual cookies and comparable technologies. The current storage periods can be found in our Cookie Policy and within the cookie settings.
20. Your Rights
Subject to the applicable legal requirements, you have in particular the following rights:
- Right of access to your personal data pursuant to Art. 15 GDPR,
- Right to rectification of inaccurate personal data and completion of incomplete personal data pursuant to Art. 16 GDPR,
- Right to erasure pursuant to Art. 17 GDPR,
- Right to restriction of processing pursuant to Art. 18 GDPR,
- Right to data portability pursuant to Art. 20 GDPR,
- Right to object pursuant to Art. 21 GDPR, and
- Right to withdraw consent pursuant to Art. 7(3) GDPR.
The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of your consent before its withdrawal.
21. Right to Object pursuant to Art. 21 GDPR
Where we process personal data on the basis of Art. 6(1)(e) or (f) GDPR, you have the right, on grounds relating to your particular situation, to object at any time to the processing of your personal data.
Where personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing purposes.
22. Right to Lodge a Complaint with a Supervisory Authority
Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes the GDPR.
For a controller based in Bremen, the competent supervisory authority is in particular:
The State Commissioner for Data Protection and Freedom of Information of the Free Hanseatic City of Bremen
(Die Landesbeauftragte für Datenschutz und Informationsfreiheit der Freien Hansestadt Bremen)
Arndtstraße 1
27570 Bremerhaven
Germany
Your right to contact any other supervisory authority competent pursuant to Art. 77 GDPR remains unaffected.
23. Automated Decision-Making
As a general rule, we do not use decision-making based solely on automated processing, including profiling, within the meaning of Art. 22 GDPR, unless otherwise expressly stated in relation to a specific service.
24. Amendments to this Privacy Policy
We reserve the right to amend this Privacy Policy where changes to our website, the services we use or applicable legal requirements make this necessary.
Last updated: August 2026