Data protection

Controller Responsible for Data Processing

The controller within the meaning of Art. 4 No. 7 GDPR is the party who alone or jointly with others determines the purposes and means of the processing of personal data. 
The controller responsible for data processing on this website is: 

DR-WALTER GmbH
Eisenerzstraße 34
53819 Neunkirchen-Seelscheid
Germany 

T +49 2247 9194-0
F +49 2247 9194-40 

You can reach our Data Protection Officer in accordance with Art. 37 GDPR at:
datenschutz@dr-walter.com 

Hosting and Content Delivery Network (CND)

Our website is operated using the infrastructure of the service provider Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. 
The data traffic between your browser and our website is technically routed through Cloudflare’s network. This enables Cloudflare to analyze traffic, block malicious access attempts and accelerate the delivery of our website. A data processing agreement pursuant to Art. 28 GDPR has been concluded with Cloudflare. 

In the course of this provision, personal data may be processed, in particular: 
Whenever our website is accessed, our system automatically collects data and information that are technically necessary to provide the content of our website and to ensure the stability and security of our systems. 

In particular, the following data may be collected 

• Browser type and browser version
• Operating system used
• Hostname of the accessing device
• IP address
• Date and time of access
• Pages and resources accessed
• Referrer URL
• Notification of successful retrieval
• Amount of data transferred 

This data is stored in server log files. The processing of log file data is carried out exclusively to ensure the functioning, stability, and security of our information technology systems. We do not use the log file data to directly identify you. However, the IP address may still constitute personal data within the meaning of the GDPR. 

Hosting Mittwald 

Our website is hosted by the service provider Mittwald CM Service GmbH & Co. KG, Königsberger Straße 4–6, 32339 Espelkamp, Germany (hereinafter “Mittwald”). 

Mittwald provides the technical infrastructure necessary to operate this website. In this context, when the website is accessed, information is automatically processed in so-called server log files. This may include, in particular, the following data: 

• IP address of the requesting device
• Date and time of access
• Accessed page or file
• Amount of data transferred
• Notification of successful retrieval
• Browser type and browser version
• Operating system used
• Referrer URL (previously visited page) 

The processing of this data is carried out to ensure the technical functionality, stability, and security of the website, especially for defending against attack attempts and for error analysis. 

The use of this hosting provider is based on our legitimate interest in the secure and efficient provision of our online offering pursuant to Art. 6(1)(f) GDPR. 

A data processing agreement pursuant to Art. 28 GDPR has been concluded with Mittwald. 

Purpose and legal basis of processing: 
Processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in the technically error-free display of the website, ensuring system stability, and protecting against unauthorized access and cyberattacks. 

Log file data is deleted as soon as it is no longer necessary for the purpose for which it was collected, but no later than 60 days, unless required for security-related analysis. 

 

Provision of the Website and Server Log Files

Whenever our website is accessed, our system automatically collects data and information that is technically necessary to provide the content of our website and to ensure system stability and security. 

In particular, the following data is collected: 

• Browser type and browser version
• Operating system used
• Hostname of the accessing device
• IP address
• Date and time of access
• Pages and resources accessed
• Referrer URL
• Notification of successful retrieval
• Amount of data transferred 

This data is stored in server log files. The processing of log file data is carried out exclusively to ensure the functioning, stability, and security of our information technology systems. We do not use the log file data to directly identify you. However, the IP address may still constitute personal data within the meaning of the GDPR. 

Purpose and legal basis of processing: 
Processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in the technically error-free display of the website, ensuring system stability, and protecting against unauthorized access and cyberattacks. 

Log file data is deleted as soon as it is no longer necessary for the purpose for which it was collected, but no later than 60 days, unless required for security-related analysis. 

Use of Cookies and Similar Technologies

Cookies and comparable technologies are used on our website. Where these are technically necessary, processing is carried out based on Section 25(2) TDDDG and Art. 6(1)(f) GDPR. 

All non‑essential cookies and services (e.g., analytics or marketing tools) are used only after you provide explicit consent under Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. 

Detailed information on the cookies and services used—including purpose, legal basis, storage duration, and any third‑country transfers—can be found in the sections below and in the cookie settings. 

SSL/TLS Encryption

For security reasons and to protect the transmission of confidential content, this website uses SSL/TLS encryption. You can recognize an encrypted connection by the change in the browser’s address line from “http://” to “https://” and by the lock icon in your browser bar.

Encryption protects the confidentiality and integrity of the transmitted data (Art. 32 GDPR).

General Information About Cookies:

Our website uses cookies and similar technologies. Cookies are small text files that are stored on your device and do not cause any damage. They may be implemented as session cookies (deleted automatically after your visit) or persistent cookies (stored until you manually delete them or they are automatically removed by your browser). 

Cookies may be set by us (first‑party cookies) or by third‑party providers (third‑party cookies). 

Cookies serve various functions. Technically necessary cookies are required to provide the website and enable essential functions (e.g., page navigation, security, consent storage). Non‑essential cookies (e.g., analytics or marketing cookies) support statistical analysis, improvement of our offerings, or personalized content. 

Storing or accessing information on your device via technically necessary cookies is based on Section 25(2) TDDDG. Non‑essential cookies require your consent under Section 25(1) TDDDG. 

Where personal data is processed in connection with cookie usage, processing is based on Art. 6(1)(f) GDPR for necessary cookies (legitimate interests in secure and functional website delivery). For cookies requiring consent, processing is based on Art. 6(1)(a) GDPR. 

You may configure your browser to inform you about cookie placement, allow cookies only in specific cases, or prevent them entirely. Disabling cookies may impair website functionality. 

Information on which cookies and services are used—including purpose, storage duration, third‑country transfers, and legal basis—is available in the cookie settings. You may withdraw or adjust your consent at any time using the cookie settings.

Use of the Consent Manager

Provider: Consentmanager AB, Håltegelvägen 1b, 72348 Västerås, Sweden.
Website: https://www.consentmanager.net
Additional Information & Privacy: https://www.consentmanager.net/datenschutz/ 

Purpose and legal basis: 
We use the consent management tool from consentmanager.net to obtain, manage, and document legally required consent for cookies and comparable technologies. The specific cookies and services used are described in detail in the cookie settings. The tool is used to comply with legal obligations under Art. 6(1)(c) GDPR in conjunction with Section 25 TDDDG and Art. 7(1) GDPR (proof of consent). 

The following data may be processed when collecting and documenting your consent: 

• Consent status and selected settings
• Date and time of decision
• Pseudonymous consent ID
• Technical information (e.g., truncated IP address, browser and device details) 

Consent data is stored as long as required to fulfill legal proof obligations. Processing generally occurs within the European Union. If third‑country transfers occur, they are carried out in compliance with Art. 44 et seq. GDPR. 

You may change or withdraw your consent at any time with future effect via the cookie settings. 

Additional Information About Cookie Service Providers:

Facebook Pixel with Custom Audiences 

Provider: Meta Platforms Ireland Limited, Ireland. Meta Platforms Ireland Limited is a subsidiary of Meta Platforms, Inc., USA. 

Website: https://www.facebook.com/business/help/744354708981227?id=2469097953376494 
Additional Information & Privacy: 
https://www.facebook.com/privacy/policy/ 
https://de-de.facebook.com/policies/cookies/ 
https://www.facebook.com/help/566994660333381?ref=dp 
https://de-de.facebook.com/help/568137493302217 

Purpose and legal basis of processing: 
Use of the Meta Pixel to measure the effectiveness of advertising campaigns and to optimize our marketing efforts. We also enable redirection to our Facebook page via a link. 
The Meta Pixel is activated only after your explicit consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. 
Simple linking to our Facebook page is based on our legitimate interest under Art. 6(1)(f) GDPR to present our company and services on social networks and to interact with users. 

Where personal data is collected and transmitted to Meta via the Meta Pixel, joint controllership pursuant to Art. 26 GDPR exists between us and Meta Platforms Ireland Limited with respect to the collection and transmission of event data. The applicable “Controller Addendum” can be accessed here: 
https://www.facebook.com/legal/controller_addendum 

Under the joint controllership arrangement pursuant to Art. 26 GDPR, we are responsible for obtaining valid consent and providing information about data processing. Meta is independently responsible for further processing of event data, particularly for analytics and advertising purposes. 

Data subject rights may be exercised with both us and Meta. Further details on Meta’s data processing can be found in Meta’s Privacy Policy. 

If the Meta Pixel is activated, personal data may be transferred to servers of Meta Platforms Inc. in the USA. Such transfers are carried out in accordance with Art. 44 et seq. GDPR. 
Meta Platforms Inc. is certified under the EU‑US Data Privacy Framework (https://www.dataprivacyframework.gov). 
Additionally, EU Standard Contractual Clauses may apply. 

You may withdraw your consent at any time with future effect via our consent management tool. 

 

Google Ads Conversion Tracking 

Provider: Within the European Economic Area (EEA) and Switzerland, Google services are provided by Google Ireland Limited, Ireland. Google Ireland Limited is a subsidiary of Google LLC, USA. 

Website: https://support.google.com/google-ads/answer/1722022?hl=de 
Additional Information & Privacy: https://policies.google.com/privacy?hl=de 

Purpose and legal basis of processing: 
Measurement of conversions and analysis of the effectiveness of Google advertising campaigns. The insights obtained are used for statistical evaluation and optimization of our marketing activities. 
Google Ads Conversion Tracking is activated only after explicit consent according to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. 

If Conversion Tracking is enabled, a transfer of personal data to servers of Google LLC in the USA cannot be excluded. Such transfers are carried out in accordance with Art. 44 et seq. GDPR. 
Google LLC is certified under the EU‑US Data Privacy Framework (https://www.dataprivacyframework.gov). 
Depending on the individual service, EU Standard Contractual Clauses may additionally apply. More information: https://business.safety.google/gdpr/ 

You may withdraw your consent at any time with future effect via our consent management tool. 

 

Google Analytics 

Provider: Within the European Economic Area (EEA) and Switzerland, Google services are provided by Google Ireland Limited, Ireland. Google Ireland Limited is a subsidiary of Google LLC, United States of America. 

Website: https://marketingplatform.google.com/intl/de/about/analytics/ 
Additional Information & Privacy: 
https://support.google.com/analytics/answer/6004245?hl=de 
https://policies.google.com/privacy?hl=de 

Purpose and legal basis of processing: 
Analysis of user behavior for statistical evaluation, reach measurement, and continuous improvement of our online offerings. Google Analytics uses technologies that make it possible to recognize users and analyze website usage. 
Processing occurs only with your explicit consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. Google Analytics is not activated prior to your consent. 

Transfers of personal data to Google LLC servers in the USA cannot be excluded. Such transfers comply with Art. 44 et seq. GDPR. 
Google LLC is certified under the EU‑US Data Privacy Framework. 
EU Standard Contractual Clauses may also apply. Details: https://business.safety.google/gdpr/ 

You can withdraw your consent at any time with future effect via our consent management tool. 

 

Google Tag Manager 

Provider: Within the EEA and Switzerland, Google services are provided by Google Ireland Limited, Ireland. Google Ireland Limited is a subsidiary of Google LLC, USA. 

Website: https://support.google.com/tagmanager/answer/6102821?hl=de 
Additional Information & Privacy: https://policies.google.com/privacy?hl=de 

Purpose and legal basis of processing: 
Management and control of tracking and marketing tags on our website. According to Google, Google Tag Manager itself does not set cookies and does not process personal data. However, services integrated via the Tag Manager may process personal data. 
Where consent‑based services are controlled through the Tag Manager, activation occurs only after your explicit consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. 
The Tag Manager itself is used based on our legitimate interest pursuant to Art. 6(1)(f) GDPR to operate our website efficiently and in a structured manner. 

You may withdraw your consent at any time with future effect via our consent management tool. 

 

Microsoft Conversion Tracking 

Provider: Within the EEA and Switzerland, Microsoft services are provided by Microsoft Ireland Operations Limited, Ireland. Microsoft Ireland Operations Limited is a subsidiary of Microsoft Corporation, USA. 

Website: https://about.ads.microsoft.com/ 
Additional Information & Privacy: https://privacy.microsoft.com/de-de/privacystatement 

Purpose and legal basis of processing: 
Measurement of conversions and analysis of advertising effectiveness within the Microsoft advertising network (e.g., Bing Ads). The data collected is used to optimize our marketing efforts. Activation occurs only after explicit consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. 

Transfers of personal data to Microsoft Corporation servers in the USA may occur. These transfers comply with Art. 44 et seq. GDPR. 
Microsoft is certified under the EU‑US Data Privacy Framework. 
EU Standard Contractual Clauses may apply additionally. 

You may withdraw your consent at any time with future effect using our consent management tool. 

 

YouTube 

Provider: Within the European Economic Area (EEA) and Switzerland, Google services are provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Ireland Limited is a subsidiary of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. 

Website: https://www.youtube.com 
Additional Information & Privacy: https://policies.google.com/privacy?hl=de 

Purpose and legal basis of processing: 
Embedding and displaying videos for user‑friendly information delivery on our website. Embedding occurs only after your explicit consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. YouTube content is not loaded prior to consent. 

When activating a YouTube video, personal data may be transferred to servers of Google LLC in the United States. The data transfer is carried out in compliance with Art. 44 et seq. GDPR. Google LLC is certified under the EU‑US Data Privacy Framework. 
Depending on the service, EU Standard Contractual Clauses may also apply. Details: https://business.safety.google/gdpr/ 

You may withdraw your consent at any time with future effect through our consent management tool. 

We also link to our YouTube channel on our website. By clicking the link, you leave our website and are redirected to YouTube (a service of Google Ireland Ltd.). Personal data may then be processed by YouTube. More information: 
https://www.youtube.com/howyoutubeworks/our-policies/. 

 

Microsoft Clarity 

Provider: Within the EEA and Switzerland, Microsoft services are provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Microsoft Ireland Operations Limited is a subsidiary of Microsoft Corporation, One Microsoft Way, Redmond, WA 98052‑6399, USA. 

Website: https://clarity.microsoft.com 
Additional Information & Privacy: https://privacy.microsoft.com/de-de/privacystatement 

Purpose and legal basis of processing: 
Microsoft Clarity is a web analytics tool that allows us to analyze user behavior on our website. This includes evaluating mouse movements, click behavior, scroll activity, device information, and interactions with page content. The analysis aims to improve user experience, optimize our content, and further develop our online offering. 
Use of Microsoft Clarity occurs only after your explicit consent under Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. 

Transfers of personal data to Microsoft Corporation servers in the USA cannot be excluded. Such transfers comply with Art. 44 et seq. GDPR. Microsoft is certified under the EU‑US Data Privacy Framework. 
Where necessary, EU Standard Contractual Clauses also apply: 
https://learn.microsoft.com/de-de/compliance/regulatory/gdpr. 

You may withdraw your consent at any time with future effect via the cookie settings. 

Use of JavaScript

Our website uses JavaScript to improve visual presentation, enable navigation between pages, and technically support operation of our online forms. 

JavaScript is provided exclusively on our local servers and executed on your device. No data is transferred to third parties in this context. 

Where technically necessary personal data (e.g., IP address, browser details, date and time of access) is processed, this is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable, and functional operation of our website. 

Processing of personal data transmitted through our contact forms is conducted solely for the specified purpose and is described separately under “Contact Form”. 

Contact via E‑mail, Telephone, Fax, or Contact Form

If you contact us by e‑mail, telephone, fax, or contact form, your inquiry including all resulting personal data (name, inquiry) will be stored and processed to handle your request. We do not share this data without your consent. 

Processing is based on Art. 6(1)(b) GDPR where your inquiry relates to contractual matters or required pre‑contractual steps. In all other cases, processing is based on our legitimate interest in effective response management (Art. 6(1)(f) GDPR) or your consent (Art. 6(1)(a) GDPR), where obtained. 
Where health data is processed, this occurs solely based on explicit consent under Art. 9(2)(a) GDPR in conjunction with Art. 6(1)(a) GDPR. Consent may be withdrawn at any time. 

Data from contact inquiries is retained until you request deletion, withdraw consent, or the purpose for storage no longer applies (e.g., once your inquiry is completed). Mandatory statutory retention requirements remain unaffected. 

Use of Flixcheck Forms

To ensure secure and efficient communication, we use Flixcheck GmbH for our online questionnaires. The Flixcheck widget enables secure transmission of contract documents and efficient handling of claims, withdrawal requests, and other inquiries. 
Legal basis: Art. 6(1)(b) GDPR. 

Where processing is not related to contract execution or initiation, the legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in processing your inquiry and ensuring secure data transmission. 

Flixcheck GmbH processes personal data as a processor. More information: 
https://www.flixcheck.de/datenschutz/. 

Use of the Online Booking/Policy Issuance System

When using our online policy issuance system, we process the personal data you provide for the preparation, conclusion, and execution of the insurance contract. This may include in particular: 

Master data: e.g., name, date of birth, place of birth
Contact and address data: address, e‑mail address, telephone number
Travel data: travel period, destination country, purpose of travel
Product‑specific information: e.g., start of studies, information about children
Health information where necessary for risk assessment or claims handling 

Without providing this information, an insurance contract cannot be concluded. 

Purpose and legal basis of processing:
Processing is carried out for the purpose of contract initiation, contract conclusion, and contract administration for the requested travel insurance.
For data necessary for pre‑contractual measures and contract fulfillment, processing is based on Art. 6(1)(b) GDPR.
Where health data is processed, this is done exclusively based on your explicit consent under Art. 9(2)(a) GDPR in conjunction with Art. 6(1)(a) GDPR. 

Your personal data may be shared with third parties, particularly the insurance carrier, only where necessary to carry out the insurance relationship or handle the insurance claim. Transfer is limited to the minimum required. 

Further information, particularly regarding your rights as a data subject, is available in our customer privacy notice.

Data Subject Rights

Under the GDPR, data subjects have the following rights regarding the processing of their personal data: 

Right of Access, Art. 15 GDPR 

You have the right to obtain information about processed data, purposes, and recipients. Access may be denied in exceptional cases if overriding interests of third parties or statutory confidentiality obligations apply. 

Right to Rectification, Art. 16 GDPR 

You may request the correction of inaccurate or completion of incomplete personal data without delay. 

Right to Erasure, Art. 17 GDPR 

You may request the deletion of your personal data where the statutory requirements are met—for example, when processing is no longer necessary or consent has been withdrawn. 

If deletion is not possible due to statutory, organizational, or contractual retention requirements, or if deletion would disproportionately impair legitimate interests, processing will instead be restricted (“blocked”).
Data is also blocked if its accuracy is contested and cannot be verified. 

Right to Restriction of Processing, Art. 18 GDPR 

Restriction may be requested where prerequisites apply, e.g., when the accuracy of data is disputed or processing is unlawful. 

Right to Object, Art. 21 GDPR 

You may object at any time to processing of your personal data, particularly where processing is based on legitimate interests or used for direct marketing. 

Your consent and declaration of medical confidentiality may be withdrawn at any time with future effect. Processing prior to withdrawal remains lawful. 
If certain processing activities are contractually required, withdrawing consent may result in limitations in service delivery. 

Objections must be submitted to the controller listed above via mail, fax, or e‑mail, including your full name, contact information, and—if available—your insurance number. 

Exercising Data Subject Rights 

To exercise your rights, you may contact the company’s Data Protection Officer at any time by mail or e‑mail: 
DR-WALTER GmbH, Datenschutzbeauftragter, Eisenerzstraße 34, 53819 Neunkirchen‑Seelscheid 
or datenschutz@dr-walter.com. 
For security reasons, proof of identity may be required. 

Right to Lodge a Complaint with a Supervisory Authority, Art. 77 GDPR 

You have the right to file a complaint with a data protection supervisory authority, particularly in the EU member state of your habitual residence, workplace, or place of alleged infringement. 

The competent authority for us in Germany is: 

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein‑Westfalen 
Postfach 20 04 44
40102 Düsseldorf
Germany
E‑mail: poststelle@ldi.nrw.de 

Transfer of Data to Third Countries 

Some service providers/recipients may process data in third countries. 
In such cases, we ensure an adequate level of data protection—for example through an EU Commission adequacy decision (including the EU–US Data Privacy Framework) or EU Standard Contractual Clauses (SCCs), and, where necessary, additional technical and organizational safeguards. 

Automated Decision‑Making / Profiling, Art. 22 GDPR 

No automated decision‑making, including profiling, takes place within the meaning of Art. 22 GDPR. 

Data Security 

We protect your personal data through a wide range of technical and organizational measures that comply with current standards and are regularly reviewed and improved. 
All employees are trained in data protection and the secure, responsible handling of customer data. 
All employees are bound by confidentiality and have signed relevant confidentiality and data protection commitments.

Our privacy policy (version 7 of 22 December 2021*) will regularly be adapted to the developments of privacy regulations and security technology.

You should inform us immediately if you feel that your property right is being violated by this website so that we can quickly help you or solve the problem.

Please feel free to contact us at any time for further information on data protection.

*History:
version 1 of 31 August 2012;
version 2 of 20 April 2016: references to the use of cookies, Google Analytics, Facebook plugins and Google Remarketing;
version 3 of 16 January 2017: references to the use of remarketing and conversion tracking;
version 4 of 16 May 2018: General Data Protection Regulation (GDPR);
version 5 of 12 November 2020: Updated list of service providers;
version 6 of 2 June 2021: Updated list of service providers;
version 7 of 22 December 2021: Updated list of service providers.
version 8 of 9 June 2023: Updated list of service providers.
version 9 of 27 February 2026: Updated Data protection notes.
 

If you have any questions or comments, please contact our Data Protection Officer directly: