Dataprotection

DR-WALTER is pleased about your interest in our company and our websites. The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data includes all data that can be used to personally identify you.

Controller Responsible for Data Processing

The controller within the meaning of Art. 4 No. 7 GDPR is the party who alone or jointly with others determines the purposes and means of the processing of personal data.
The controller responsible for data processing on this website is:

DR-WALTER GmbH
Eisenerzstraße 34
53819 Neunkirchen-Seelscheid
Germany

T +49 2247 9194-0
F +49 2247 9194-40

You can reach our Data Protection Officer in accordance with Art. 37 GDPR at:
datenschutz@dr-walter.com

Provision of the Website and Server Log Files

Whenever our website is accessed, our system automatically collects data and information that is technically necessary to provide the content of our website and to ensure system stability and security.

In particular, the following data is collected:

Browser type and browser version

Operating system used

Hostname of the accessing device

IP address

Date and time of access

Pages and resources accessed

Referrer URL

Notification of successful retrieval

Amount of data transferred

This data is stored in server log files. The processing of log file data is carried out exclusively to ensure the functioning, stability, and security of our information technology systems. We do not use the log file data to directly identify you. However, the IP address may still constitute personal data within the meaning of the GDPR.

Purpose and legal basis of processing:
Processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in the technically error-free display of the website, ensuring system stability, and protecting against unauthorized access and cyberattacks.

Log file data is deleted as soon as it is no longer necessary for the purpose for which it was collected, but no later than 60 days, unless required for security-related analysis.

Use of Cookies and Similar Technologies

Cookies and comparable technologies are used on our website. Where these are technically necessary, processing is carried out based on Section 25(2) TDDDG and Art. 6(1)(f) GDPR.

All non‑essential cookies and services (e.g., analytics or marketing tools) are used only after you provide explicit consent under Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR.

Detailed information on the cookies and services used—including purpose, legal basis, storage duration, and any third‑country transfers—can be found in the sections below and in the cookie settings.

SSL/TLS Encryption

For security reasons and to protect the transmission of confidential content, this website uses SSL/TLS encryption. You can recognize an encrypted connection by the change in the browser’s address line from “http://” to “https://” and by the lock icon in your browser bar.

Encryption protects the confidentiality and integrity of the transmitted data (Art. 32 GDPR).

Use of Cookies

General Information About Cookies

Our website uses cookies and similar technologies. Cookies are small text files that are stored on your device and do not cause any damage. They may be implemented as session cookies (deleted automatically after your visit) or persistent cookies (stored until you manually delete them or they are automatically removed by your browser).

Cookies may be set by us (first‑party cookies) or by third‑party providers (third‑party cookies).

Cookies serve various functions. Technically necessary cookies are required to provide the website and enable essential functions (e.g., page navigation, security, consent storage). Non‑essential cookies (e.g., analytics or marketing cookies) support statistical analysis, improvement of our offerings, or personalized content.

Storing or accessing information on your device via technically necessary cookies is based on Section 25(2) TDDDG. Non‑essential cookies require your consent under Section 25(1) TDDDG.

Where personal data is processed in connection with cookie usage, processing is based on Art. 6(1)(f) GDPR for necessary cookies (legitimate interests in secure and functional website delivery). For cookies requiring consent, processing is based on Art. 6(1)(a) GDPR.

You may configure your browser to inform you about cookie placement, allow cookies only in specific cases, or prevent them entirely. Disabling cookies may impair website functionality.

Information on which cookies and services are used—including purpose, storage duration, third‑country transfers, and legal basis—is available in the cookie settings. You may withdraw or adjust your consent at any time using the cookie settings.

Use of the Consent Manager

Provider: Consentmanager AB, Håltegelvägen 1b, 72348 Västerås, Sweden.
Website: https://www.consentmanager.net
Additional Information & Privacy: https://www.consentmanager.net/datenschutz/

Purpose and legal basis:
We use the consent management tool from consentmanager.net to obtain, manage, and document legally required consent for cookies and comparable technologies. The specific cookies and services used are described in detail in the cookie settings. The tool is used to comply with legal obligations under Art. 6(1)(c) GDPR in conjunction with Section 25 TDDDG and Art. 7(1) GDPR (proof of consent).

The following data may be processed when collecting and documenting your consent:

Consent status and selected settings

Date and time of decision

Pseudonymous consent ID

Technical information (e.g., truncated IP address, browser and device details)

Consent data is stored as long as required to fulfill legal proof obligations. Processing generally occurs within the European Union. If third‑country transfers occur, they are carried out in compliance with Art. 44 et seq. GDPR.

You may change or withdraw your consent at any time with future effect via the cookie settings.

Additional Information About Cookie Service Providers

Google Analytics

Provider: Within the European Economic Area (EEA) and Switzerland, Google services are provided by Google Ireland Limited, Ireland. Google Ireland Limited is a subsidiary of Google LLC, United States of America.

Website: https://marketingplatform.google.com/intl/de/about/analytics/
Additional Information & Privacy:
https://support.google.com/analytics/answer/6004245?hl=de
https://policies.google.com/privacy?hl=de

Purpose and legal basis of processing:
Analysis of user behavior for statistical evaluation, reach measurement, and continuous improvement of our online offerings. Google Analytics uses technologies that make it possible to recognize users and analyze website usage.
Processing occurs only with your explicit consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. Google Analytics is not activated prior to your consent.

Transfers of personal data to Google LLC servers in the USA cannot be excluded. Such transfers comply with Art. 44 et seq. GDPR.
Google LLC is certified under the EU‑US Data Privacy Framework.
EU Standard Contractual Clauses may also apply. Details: https://business.safety.google/gdpr/

You can withdraw your consent at any time with future effect via our consent management tool.

Google Tag Manager

Provider: Within the EEA and Switzerland, Google services are provided by Google Ireland Limited, Ireland. Google Ireland Limited is a subsidiary of Google LLC, USA.

Website: https://support.google.com/tagmanager/answer/6102821?hl=de
Additional Information & Privacy: https://policies.google.com/privacy?hl=de

Purpose and legal basis of processing:
Management and control of tracking and marketing tags on our website. According to Google, Google Tag Manager itself does not set cookies and does not process personal data. However, services integrated via the Tag Manager may process personal data.
Where consent‑based services are controlled through the Tag Manager, activation occurs only after your explicit consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG.
The Tag Manager itself is used based on our legitimate interest pursuant to Art. 6(1)(f) GDPR to operate our website efficiently and in a structured manner.

You may withdraw your consent at any time with future effect via our consent management tool.

Use of JavaScript

Our website uses JavaScript to improve visual presentation, enable navigation between pages, and technically support operation of our online forms.

JavaScript is provided exclusively on our local servers and executed on your device. No data is transferred to third parties in this context.

Where technically necessary personal data (e.g., IP address, browser details, date and time of access) is processed, this is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable, and functional operation of our website.

Processing of personal data transmitted through our contact forms is conducted solely for the specified purpose and is described separately under “Contact Form”.

Contact via E‑mail, Telephone, Fax, or Contact Form

If you contact us by e‑mail, telephone, fax, or contact form, your inquiry including all resulting personal data (name, inquiry) will be stored and processed to handle your request. We do not share this data without your consent.

Processing is based on Art. 6(1)(b) GDPR where your inquiry relates to contractual matters or required pre‑contractual steps. In all other cases, processing is based on our legitimate interest in effective response management (Art. 6(1)(f) GDPR) or your consent (Art. 6(1)(a) GDPR), where obtained.
Where health data is processed, this occurs solely based on explicit consent under Art. 9(2)(a) GDPR in conjunction with Art. 6(1)(a) GDPR. Consent may be withdrawn at any time.

Data from contact inquiries is retained until you request deletion, withdraw consent, or the purpose for storage no longer applies (e.g., once your inquiry is completed). Mandatory statutory retention requirements remain unaffected.

Use of the Online Booking/Policy Issuance System

When using our online policy issuance system, we process the personal data you provide for the preparation, conclusion, and execution of the insurance contract. This may include in particular:

Master data: e.g., name, date of birth, place of birth
Contact and address data: address, e‑mail address, telephone number
Travel data: travel period, destination country, purpose of travel
Product‑specific information: e.g., start of studies, information about children
Health information where necessary for risk assessment or claims handling

Without providing this information, an insurance contract cannot be concluded.

Purpose and legal basis of processing:
Processing is carried out for the purpose of contract initiation, contract conclusion, and contract administration for the requested travel insurance.
For data necessary for pre‑contractual measures and contract fulfillment, processing is based on Art. 6(1)(b) GDPR.
Where health data is processed, this is done exclusively based on your explicit consent under Art. 9(2)(a) GDPR in conjunction with Art. 6(1)(a) GDPR.

Your personal data may be shared with third parties, particularly the insurance carrier, only where necessary to carry out the insurance relationship or handle the insurance claim. Transfer is limited to the minimum required.

Further information, particularly regarding your rights as a data subject, is available in our customer privacy notice.

Data Subject Rights

Under the GDPR, data subjects have the following rights regarding the processing of their personal data:

Right of Access, Art. 15 GDPR

You have the right to obtain information about processed data, purposes, and recipients. Access may be denied in exceptional cases if overriding interests of third parties or statutory confidentiality obligations apply.

Right to Rectification, Art. 16 GDPR

You may request the correction of inaccurate or completion of incomplete personal data without delay.

Right to Erasure, Art. 17 GDPR

You may request the deletion of your personal data where the statutory requirements are met—for example, when processing is no longer necessary or consent has been withdrawn.

If deletion is not possible due to statutory, organizational, or contractual retention requirements, or if deletion would disproportionately impair legitimate interests, processing will instead be restricted (“blocked”).
Data is also blocked if its accuracy is contested and cannot be verified.

Right to Restriction of Processing, Art. 18 GDPR

Restriction may be requested where prerequisites apply, e.g., when the accuracy of data is disputed or processing is unlawful.

Right to Object, Art. 21 GDPR

You may object at any time to processing of your personal data, particularly where processing is based on legitimate interests or used for direct marketing.

Your consent and declaration of medical confidentiality may be withdrawn at any time with future effect. Processing prior to withdrawal remains lawful.
If certain processing activities are contractually required, withdrawing consent may result in limitations in service delivery.

Objections must be submitted to the controller listed above via mail, fax, or e‑mail, including your full name, contact information, and—if available—your insurance number.

Exercising Data Subject Rights

To exercise your rights, you may contact the company’s Data Protection Officer at any time by mail or e‑mail:
DR-WALTER GmbH, Datenschutzbeauftragter, Eisenerzstraße 34, 53819 Neunkirchen‑Seelscheid
or datenschutz@dr-walter.com.
For security reasons, proof of identity may be required.

Right to Lodge a Complaint with a Supervisory Authority, Art. 77 GDPR

You have the right to file a complaint with a data protection supervisory authority, particularly in the EU member state of your habitual residence, workplace, or place of alleged infringement.

The competent authority for us in Germany is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein‑Westfalen
Postfach 20 04 44
40102 Düsseldorf
Germany
E‑mail: poststelle@ldi.nrw.de

Transfer of Data to Third Countries

Some service providers/recipients may process data in third countries.
In such cases, we ensure an adequate level of data protection—for example through an EU Commission adequacy decision (including the EU–US Data Privacy Framework) or EU Standard Contractual Clauses (SCCs), and, where necessary, additional technical and organizational safeguards.

Automated Decision‑Making / Profiling, Art. 22 GDPR

No automated decision‑making, including profiling, takes place within the meaning of Art. 22 GDPR.

Data Security

We protect your personal data through a wide range of technical and organizational measures that comply with current standards and are regularly reviewed and improved.
All employees are trained in data protection and the secure, responsible handling of customer data.
All employees are bound by confidentiality and have signed relevant confidentiality and data protection commitments.