Data protection

Responsible body
We, OstWestfalenLippe GmbH, Walther-Rathenau-Straße 33-35, 33602 Bielefeld, 0521-967330, info@ostwestfalen-lippe.de, as the responsible body, would like to explain below which of your data we process and how.

Data protection officer
If you have any questions about data protection, please contact our Datenschutzbeauftragter Mr Thomas Werning.

He can be reached at:
werning.com GmbH – Dieselstraße 12 – 32791 Lage, 
Email: dsb-owl-gmbh-bi@werning.com, Tel.: +49 5232 980-4700

Below you will find information about which personal data (this is all data that identifies you as a natural person (hereinafter referred to as ‘data subject’) or makes you identifiable, such as your name, address, email address or user behaviour) we collect during your visit to our website and how it is used. Data subjects are visitors to our website and users of our online services.

Data security/encryption
This website uses ‘Hypertext Transfer Protocol Secure’ (https). The connection between your browser and our server is encrypted.

Your rights as a data subject

Right to lodge a complaint: If you believe that the processing of your personal data violates the General Data Protection Regulation, you have the right to lodge a complaint with the data protection supervisory authority responsible for us, the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, www.ldi.nrw.de, as well as to any other data protection supervisory authority.

Right of revocation: You may revoke any consent you have given with effect for the future in accordance with Art. 7 DSGVO.

Right to information, deletion and correction: In accordance with Art. 15 DSGVO, you have the right to obtain information about the data stored about you, including any recipients and the planned storage period. If incorrect personal data is processed, you have the right to correction in accordance with Art. 16 DSGVO. If the legal requirements are met, you can request the erasure or restriction of processing and object to the processing (Articles 17, 18 and 21 DSGVO). If you wish to have your data erased but we are still legally obliged to retain it, access to your data will be restricted (blocked). The same applies in the event of an objection. You can exercise your right to data portability insofar as the technical capabilities are available at the recipient's and our end.

Mr Thomas Werning is available to assist you with your data subject rights and can be contacted using the contact details above. 

Automated decision-making and profiling 
Not currently taking place.

Intention to process data in third countries outside the EU
Does not take place as a matter of principle. For information on optional cookies, see Section III.5

Categories of recipients  
In the context of providing specific services, we use service providers who are separately bound by confidentiality and data protection obligations. Access to personal data cannot be ruled out in this context.

These categories of recipients are:
Processors employed by us (Art. 28 GDPR), particularly in the areas of IT services, taxes, logistics and printing services, who process your data for us in accordance with our instructions. Currently, these are neusta destination.one GmbH, Münchener Straße 1, D-86899 Landsberg am Lech, and consentmanager AB, Håltegelvägen 1b, 72348 Västeras, Sweden. 

Public authorities and institutions (tax authorities) in the event of a legal or official obligation.

Other bodies for which you have given us your consent to transfer data.

Data will only be passed on to authorities if there are overriding legal provisions.

Purpose of processing
When you visit our site, various data (server statistics) is automatically stored that your browser transmits to our provider's server: Among other things, the IP address of your device, the date and time of access, the name and URL of the files accessed, the website from which you accessed our site or from which you were redirected to our site (referrer URL), the browser used and, if applicable, the operating system of your device and the name of your provider are logged.

We process the aforementioned data for the purposes of establishing a smooth connection and ensuring system security. This data is not merged with other data sources. The IP address is anonymised. The connection data is automatically deleted, usually after a maximum of seven days. If the website is misused, log data that needs to be kept for evidence purposes will be retained until the incident has been clarified.

The legal basis is Art. 6(1)(f) DSGVO and Section 25(2) TDDDG (in this case, however, only data that is transmitted when you visit our website, such as browser or header information, either because it is necessary or because of the (browser) settings of the end device). This is not to be regarded as ‘access to information already stored in the terminal equipment’. Our legitimate interest pursuant to Art. 6 (1) (f) DSGVO arises from the fact that we want to ensure the secure operation of the website and detect any attacks.

Purpose of data processing
The ‘wish list’ function allows you to save items or content on our website so that you can find them more easily later. We use your browser's local storage to save your selection.
We store the following data in local storage:
Item IDs or identifiers: These are required to identify the content or items you have selected.
Date and time of storage: To track when the watch list was updated.
LocalStorage: The data is stored locally in your browser and is only accessible to you. You can remove the stored data at any time by deleting your browser's LocalStorage data.

Duration of storage: The data remains stored in LocalStorage until you delete it manually or until it is automatically deleted when you clear your browser cache.
Use of data: The data stored in LocalStorage is used exclusively to manage and display your watch list on our website. The data is not passed on to third parties.

The legal basis for processing users' personal data is Article 6(1)(f) DSGVO for legitimate interests. Our legitimate interest arises from the fact that storage is only necessary for technical reasons and does not involve any personal references.

III. 4. Location query (geolocation) in the browser

Purpose and scope of data processing
We only process your location if you expressly consent to the location query in the browser. The purpose of the location query is to provide you with location-based services (e.g. display of events in your area, personalised content such as navigation).   

If you consent to location tracking, geographical coordinates (e.g. longitude and latitude), IP address and, if necessary, additional technical information about your device will be processed in order to determine your approximate location.   

Legal basis
Processing is based on your consent in accordance with Art. 6 (1) (a) DSGVO. No location query will be made without your consent. 

Transfer of data
Data will only be transferred to our service provider neusta one.destination GmbH (see above) within the scope of order data processing, if this is necessary for the provision of services. 

Storage period
The location data is anonymised after you have finished using the website and is statistically evaluated to improve the service. Your personal location data is not stored permanently, but is only processed for the respective usage session and deleted once the purpose has been fulfilled. 

Revocation of consent
You can revoke your consent to location tracking at any time by clicking on the icon (see image on the right) at the right end of the address bar in your browser and then selecting ‘Block access’.  

Purpose of processing
This site uses cookies. Cookies are text files that are stored in the internet browser or by the internet browser on the user's computer system. When a user accesses a website, a cookie may be stored on the user's operating system. This cookie contains a characteristic string of characters that enables the browser to be uniquely identified when the website is accessed again. 

5. 1 Technically necessary cookies
Function: These cookies and similar technologies are used for activities that are strictly necessary to operate or provide the service you have requested. They do not require your consent and cannot be disabled. 

The legal basis for technically necessary cookies is Art. 6 (1) (f) GDPR and § 25 (1) TDDDG. Our legitimate interest arises from the fact that we only use the aforementioned cookies to make it easier for you to access the site, do not collect any tracking data and therefore do not interfere with your personal rights and fundamental freedoms.

You can disable cookies in your web browser. However, this may lead to impairments in functionality.

5. 2  Other cookies (for marketing and analysis purposes)
Marketing: These cookies and similar technologies help us to deliver personalised advertising or marketing content to you and to measure its effectiveness. 

Measurement: Cookies and similar technologies enable us to measure how many users visit our website and to observe how you interact with our services, which helps us to make improvements. We only use such technically necessary cookies if you have given us your express consent to do so.

You can change or revoke your consent at any time via the consent banner, which you will find on our website via the cookie icon in the bottom left-hand corner.

5. 3  Detailed information about cookies
We use the following cookies (with your consent, where applicable). The privacy policy of the respective provider can be found in the first table on the right under the link ‘Privacy Policy’. Further information about the provider and the purpose of its data use can be found in the list of providers in the drop-down menu. 

Measurement: With the help of cookies and similar technologies, we are able to measure how many users visit our website and observe how you interact with our services, which helps us to make improvements. We only use such technically necessary cookies if you have given us your express consent to do so.

You can change or revoke your consent at any time via the consent banner, which you will find on our website via the cookie icon in the lower left corner.

Name: Experiencename_Lng
Content: Longitude (from experience, or from user if shared)
Duration: 24 hours
Type: Technical cookie

Name: Experiencename_Lat
Content: Latitude (from experience, or from user if shared)
Duration: 24 hours
Type: Technical cookie

Name: _et4frontend_session
Content: sessionid pages
Duration: Browser session
Type: Technical cookie

Name: ASP.NET_Sessionid
Content: sessionid meta
Duration: Browser session
Type: Technical cookie

Name: cookieConsent
Content: May cookies be stored (user selection). Only if true, 3rd party cookies are permitted/stored
Duration: forever
Type: User setting

We use cookies from the following third-party providers:

Name: _cfduid
Content: Cloudflare ID
Duration: 1 month
Type: Technical cookie
Privacy policy: https://www.cloudflare.com/privacypolicy/

Name: __cmpcccu*
Example value: aBQD-nZxgBQAzADYAHAB4AAQADgALA...
Content: consentmanager.net
Duration: 365 days
Type: Analysis cookie (requires user consent)
Privacy policy: Datenschutzerklärung ansehen

Purpose of processing 
The processing of users' personal data enables us to analyse the surfing behaviour of our users. By evaluating the data obtained, we are able to compile information about the use of the individual components of our website. This helps us to continuously improve our website and its user-friendliness. These purposes also constitute our legitimate interest in processing the data in accordance with Art. 6(1)(f) DSGVO. The anonymisation of the IP address takes sufficient account of the users' interest in the protection of their personal data.

The legal basis for the processing of users' personal data is Art. 6 (1) (a) DSGVO for consent to data processing and (f) DSGVO for legitimate interest. Our legitimate interest arises from making adjustments for optimisation and marketing purposes based on statistical analysis of user behaviour.

We use a locally operated Matomo Analytics platform and a variant that does not set cookies for data protection-compliant reach measurement. Information about the respective visit, the average time spent on the website, pages viewed and various other purely statistical measurement points are recorded. Matomo does not set any cookies without your consent and uses the 1-byte anonymised IP address for device recognition. No data is retrieved from the end device and the legal requirements are complied with.

III. 7. Map display 

Purpose of processing

We use map displays from OpenStreetMap, FOSSGIS e.V., Bundesallee 23, 10717 Berlin, on our website. The maps in the standard map view and terrain view are hosted by neusta destination.one GmbH, Mühlenstraße 153, 26789 Leer. To integrate the winter and satellite views, neusta destination.one GmbH uses an API from its subcontractor Maptiler AG, Zugerstraße 22, 6314 Unterägeri, Switzerland. The service enables us to display maps for locating tours and their routes, excursion destinations and other offers. 

The legal basis for the integration of the map display is Art. 6 (1) lit. f DSGVO. Our legitimate interest lies in the user-friendly and appealing presentation of our online offering and the easy findability of locations described on our website.    

We reserve the right to amend the content of this privacy policy at any time. This usually occurs when the services used are further developed or adapted. You can view the current privacy policy on our website. Status of this policy: 15 October 2025