With this data protection information, we inform you about our handling of your personal data and about your rights under the European General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). The controller for data processing is Miniatur Wunderland Hamburg GmbH (hereinafter referred to as "we" or "us").

Our data protection information consists of two parts. Part A provides you with general information on data protection at Miniatur Wunderland and explains, among other things, what rights you have and where you can assert them. Part B is dedicated to the various groups of data subjects and explains in detail what data we collect and process about you. We address you in your role as:

a. Visitors to our website,

b. Visitors to our blogs,

c. Participants in our forum,

d. Customers of our webshop,

e. Visitors to the Miniatur Wunderland,

f. Participants in lotteries,

g. Contact persons at service providers, suppliers and business partners with whom we interact in our daily business,

h. Applicants who would like to join our team,

i. Newsletter subscribers, who we keep up to date on a regular basis, as well as recipients of ticket notifications, who we inform about new ticket contingents,

j. Contact persons from the press,

k. Social media visitors who are interested in us, and

l. Data subjects in Switzerland.

1. Our contact details

If you have any questions or suggestions regarding this information or would like to contact us to assert your rights, please send your request to

Miniatur Wunderland Hamburg GmbH

Kehrwieder 2, Block D, 20457 Hamburg

Tel. +49 (0)49 300 68 00

e-mail info@miniatur-wunderland.de

2. On what basis do we process your data?

The data protection term "personal data" refers to all information that relates to an identified or identifiable person. We process personal data in compliance with the relevant data protection regulations, in particular the GDPR and the BDSG. Data processing by us only takes place on the basis of legal permission. We process personal data only with your consent (Art. 6 (1) (a) GDPR), for the performance of a contract to which you are a party or at your request for the implementation of pre-contractual measures (Art. 6 (1) (b) GDPR), for compliance with a legal obligation (Art. 6 (1) (c) GDPR) or if the processing is necessary to safeguard our legitimate interests or the legitimate interests of a third party, unless your interests or fundamental rights and freedoms, which require the protection of personal data, prevail (Art. 6 (1) (f) GDPR).

If you apply for an open position in our company, we will also process your personal data to decide on the establishment of an employment relationship (Section 26 (1) sent. 1 BDSG).

3. Your rights

You decide on your data! As a data subject, you therefore have the right to assert your data subject rights against us. You have the following rights within the scope of the data protection laws applicable to you:

• In accordance with Art. 15 GDPR and Section 34 BDSG, you have the right to request access as to whether or not we process personal data relating to you and, if so, to what extent.
• You have the right to demand that we rectify your data in accordance with Art. 16 GDPR.
• You have the right to demand that we erase your personal data in accordance with Art. 17 GDPR and Section 35 BDSG.
• You have the right to have the processing of your personal data restricted in accordance with Art. 18 GDPR.
• In accordance with Art. 20 GDPR, you have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller.
• If you have given us separate consent to process your data, you can withdraw this consent at any time in accordance with Art. 7 (3) GDPR. Such a withdrawal will not affect the lawfulness of processing based on consent before its withdrawal.
• If you believe that the processing of personal data concerning you violates the provisions of the GDPR, you have the right to lodge a complaint with a supervisory authority in accordance with Art. 77 GDPR.

In accordance with Art. 21 (1) GDPR, you have the right to object to processing based on the legal basis of Art. 6 (1) (e) or (f) GDPR on grounds relating to your particular situation. If we process personal data about you for the purpose of direct marketing, you can object to this processing in accordance with Art. 21 (2) and (3) GDPR.

If you exercise your rights in accordance with Art. 15 to 22 GDPR, we will process the personal data transmitted for the purpose of implementing these rights by us and to be able to provide evidence of this. We will only process data stored for the purpose of providing and preparing information for this purpose and for the purposes of data protection monitoring and will otherwise restrict processing in accordance with Art. 18 GDPR.

This processing is based on the legal basis of Art. 6 (1) (c) GDPR in conjunction with. Art. 15 to 22 GDPR and Section 34 (2) BDSG.

4. Where do we process your data?

In principle, we process your data on European servers with the highest security standards. In providing our services, we are supported by external service providers to whom we send your data. Some data processing operations may involve the transfer of certain personal data to third countries, i.e. countries in which the GDPR is not applicable law. Such a transfer is permitted if the European Commission has determined that an adequate level of data protection is required in such a third country. This applies to all transfers to countries within this list: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en.

If there is no such adequacy decision by the European Commission, personal data will only be transferred to a third country if there are suitable guarantees in accordance with Art. 46 GDPR or if one of the conditions of Art. 49 GDPR is met.

Unless an adequacy decision exists and unless otherwise stated below, we use the EU Standard Contractual Clauses (SCC) as appropriate safeguards for the transfer of personal data from the scope of the GDPR to third countries. You have the option of obtaining or viewing a copy of these EU Standard Contractual Clauses. Please contact us at the address given under Contact.

If you consent to the transfer of personal data to third countries, the transfer takes place on the legal basis of Art. 49 (1) (a) GDPR.

5. To whom and why do we pass on your personal data?

In order to provide our services and operate economically as a company, we use various external companies to which we transfer personal data in some cases. If other specific recipients contain personal data for some groups of data subjects, we will inform you about this in Part B.

6. How long do we store your data?

Unless otherwise stated in the following information, we only store the data for as long as is necessary to achieve the purpose of processing or to fulfill our contractual or legal obligations. Such statutory retention obligations may arise in particular from commercial or tax law regulations. From the end of the calendar year in which the data was collected, we will store such personal data contained in our accounting data for ten years and store personal data contained in commercial letters and contracts for six years. In addition, we will retain data in connection with consents requiring proof and with complaints and claims for the duration of the statutory limitation periods. We will delete data stored for advertising purposes if you object to processing for this purpose.

7. How do we use "cookies" and other tracking technologies?

We use cookies and similar technologies on our website and in the provision of our services. We have compiled more information about how we use these technologies in our cookie banner. The banner can be accessed via the footer of each website. There you will also find a list of other companies that place cookies on our websites, a list of cookies that we place and an explanation of how you can refuse certain types of cookies.

8. How can you contact our data protection officer?

You can reach our data protection officer using the following contact details:

E-Mail: datenschutz@miniatur-wunderland.de

Herting Oberbeck Datenschutz GmbH

https://www.datenschutzkanzlei.de.

a. Visitors to our website

We process certain personal data when you visit and interact with our website https://www.miniatur-wunderland.de/. Information on this can be found below.

1) We process data that you provide to us in contact forms, such as your name, your e-mail address and your request. This data processing is carried out for the following purposes:

• Support and communication: answering inquiries;
• Organization of trips and travel packages;
• Initiating contractual relationships, for example for groups, evening events or backstage tours.

Legal basis: Art. 6 (1) (b) GDPR, if the request is for the initiation of a contractual relationship with you or Art. 6 (1) (f) GDPR, if the request is for the initiation of a contract with other persons (e.g. your employer or another person from a group) or if it is a general question. Our legitimate interest lies in responding to such requests.

If you wish to book a travel package via our contact form, we will forward the data collected to our responsible cooperation partner (e.g. Hamburg Tourismus GmbH), who will then take care of the booking. If you book the travel packages directly via the websites of our cooperation partners (e.g. https://miwula.hamburg-tourism.de/reisepakete/), we will not receive any personal data from you.

2) We process pseudonymous information about the device and browser you are using, server log files, your network connection and your IP address for the following purposes:

• Ensuring the security, operability and stability of our services, including defense against attacks;
• Integration of third-party content (e.g. maps).

Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is to provide you with secure, attractive and user-friendly websites.

3) We process information about how you behave on the website. This includes the IP address and user IDs, some of which are assigned by third-party providers. Data processing is carried out for the following purposes:

• Reach measurement and analysis of user behavior to optimize our websites, increase customer satisfaction and error analysis;
• (Conversion) tracking for reach measurement;
• Remarketing to acquire new customers through personalized display of our advertising.

Legal basis: Art. 6 (1) (a) GDPR. You can withdraw your consent at any time via the cookie consent banner.

b. Visitors to our blogs

We operate various blogs (https://www.miniatur-wunderland.de/austausch/mehr-wunderland/blogs/). In some of these blogs, you have the opportunity to comment on or share posts, among other things. Below you will find information on data processing when visiting and interacting with the blogs.

1) We process data that you provide to us in the context of a comment, such as your name, your e-mail address and the content of your comment, for the following purposes:

• Processing and displaying the comment in our blog;
• Support and communication: answering questions.

Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is to provide you with a comment option to interact with us.

• Review of the commentary on compliance with legal requirements.

Legal basis: Art. 6 (1) (c) GDPR.

2) We process pseudonymous information about how you behave on our blogs. This includes server log files, the IP address and user IDs, some of which are assigned by third-party providers. Data processing is carried out for the following purposes:

• Provision of our blogs;
• Forwarding of data when using the "Share" function via external services;
• Ensuring the security, operability and stability of our services, including defense against attacks.

Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is to provide you with secure, user-friendly and interactive blogs.

• Reach measurement and analysis of user behavior to optimize our products, increase customer satisfaction and error analysis;

Legal basis: Art. 6 (1) (a) GDPR. You can withdraw your consent at any time via the cookie consent banner.

c. Participants in our forum

We offer interested persons the opportunity to exchange information in our forum (https://forum.miniatur-wunderland.de/) about Miniatur Wunderland in general, new construction phases and other topics relating to model construction. In doing so, we process personal data as described below.

1) We process data that you provide to us when registering and using the forum, such as your user name, your password, the content and number of your posts and your registration date. Optionally, you can store further information in your account, such as your place of residence or a photo. As a user of the forum, you also have the option of informing us of illegal content via a reporting system. We process your data for the following purposes:

• Registration of the forum account;
• Processing and display of the contribution in our forum;
• Moderation of the forum;
• Support and communication: answering questions.

Legal basis: Art. 6 (1) (b) GDPR.

• Personalization of the forum account, for example by adding a photo or your place of residence.

Legal basis: Art. 6 (1) (a) GDPR. You can change and delete the optional information in your profile at any time.

• Review of contributions for compliance with legal requirements;
• Processing reports of illegal content.

Legal basis: Art. 6 (1) (c) GDPR.

2) We process pseudonymous information about how you behave in our forum. This includes server log files, the IP address and user IDs, some of which are assigned by third-party providers. Data processing is carried out for the following purposes:

• Provision of our forum;
• Ensuring the security, operability and stability of our services, including defense against attacks.

Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is to provide you with a secure, user-friendly and interactive forum.

• Reach measurement and analysis of user behavior to optimize our products, increase customer satisfaction and error analysis.

Legal basis: Art. 6 (1) (a) GDPR. You can withdraw your consent at any time via the cookie consent banner.

d. Customers of our web shop

When you visit and interact with our web shop (https://shop.miniatur-wunderland.de/), we process your personal data as described below.

1) We process data about you that you provide when you register or make a purchase, such as your name, address and e-mail address and your chosen payment method, for the following purposes:

• Fulfillment of our service: processing the order, shipping the goods, processing the payment, returns management;
• User account: Provision of a password-protected user account, via which personal data, the wish list and the purchase history can be viewed (on request);
• Support and communication: answering inquiries.

Legal basis: Art. 6 (1) (b) GDPR.

• Non-commercial communication on technical, security and contract-related topics (e.g. fraud warnings, account blocking)
• Advertising for similar products and services.

Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is to keep you up to date with important information about your user account and similar Miniatur Wunderland products.

• Compliance with legal regulations and retention obligations.

Legal basis: Art. 6 (1) (c) GDPR.

2) We process pseudonymous information about how you behave in our web shop. This includes server log files, the IP address and user IDs, some of which are assigned by third-party providers. The data is processed for the following purposes:

• Ensuring the security, operability and stability of our shop, including defense against attacks;
• Integration of third-party content (e.g. videos).

Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is to provide a secure, clear and user-friendly online shop.

• Reach measurement and analysis of user behavior to optimize our products, increase customer satisfaction and analyze errors;
• (Conversion) tracking for reach measurement.

Legal basis: Art. 6 (1) (a) GDPR. You can withdraw your consent at any time via the cookie consent banner.

e. Visitors to the Miniatur Wunderland

Of course, we also process certain personal data of visitors to Miniatur Wunderland. How this is done is described below.

1) We process data that you provide about yourself as part of the online ticket booking process (https://www.miniatur-wunderland.de/besuch/tickets/#/buchung/). This includes in particular your name and e-mail address, the desired time slot for your visit and payment information. The data is processed for the following purposes:

• Fulfillment of our service: Processing of the ticket order, provision of e-tickets or hard tickets/vouchers, processing of payment;
• Booking of time slots to give you access without waiting;
• Support and communication: answering inquiries.

Legal basis: Art. 6 (1) (b) GDPR.

• Non-promotional communication on technical, security and contract-related topics (e.g. information for your visit);
• Advertising for similar products and services.

Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is to keep you up to date with important information about your visit and about similar Miniatur Wunderland products.

• Advertising contact by e-mail and sending out satisfaction surveys following your visit.

Legal basis: Art. 6 (1) (a) GDPR. You can withdraw your consent at any time via the unsubscribe link in the email.

• Compliance with legal regulations and retention obligations.

Legal basis: Art. 6 (1) (c) GDPR.

2) We are interested to know from which corners of the world visitors come to Miniatur Wunderland. For this reason, you can provide us with information about your current place of residence or origin as part of the online booking process or on site and tell us whether you have visited Miniatur Wunderland before. The data is processed for this purpose:

• Compilation of visitor statistics with information on the number and current place of residence/origin of visitors.

Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest lies in the collection of information to compile our visitor statistics. The indication of the origin is voluntary and not required for a visit to Miniatur Wunderland.

3) We process data that we collect from you as part of our video surveillance systems. This applies in particular to the entrance area of Miniatur Wunderland. The data processing serves the following purposes:

• Monitoring the flow of visitors;
• Ensuring compliance with safety regulations;
• Protection of domiciliary rights;
• Clarification of incidents.

Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest lies in the above-mentioned purposes. We have limited monitoring to the minimum necessary.

The video recordings are automatically deleted after 72 hours. Individual video sequences are only stored for longer than this in specific cases of suspicion or on the instructions of an authority. We only release video sequences to authorities on the basis of lawful requests for access.

f. Participants in lotteries

We run lotteries at irregular intervals in which you can take part as a visitor to Miniatur Wunderland, as a newsletter subscriber or as a visitor to our online presence. In order to carry out the lottery, we collect the data requested in each case, for example your name and e-mail address. If prizes are sent by post, we collect information on the delivery address if required.

The data processing is necessary to carry out the competition. The purpose of the data processing is to register for and run the competition and to send the prizes.

The legal basis is Art. 6 (1) (b) GDPR. Participation in the lottery is voluntary. It is not possible to take part in the lottery without providing personal data.

If you also register for our newsletter as part of the lottery registration, the information in the section "Newsletter subscribers and recipients of ticket notifications" also applies.

g. Contact persons at service providers/ suppliers/ business partners

If you get in touch with us as a contact person for our business partners, we process data that you provide to us about yourself and the company in which you work, such as your name, your e-mail address and your telephone number.

Data processing is necessary to fulfill the contract with the company in which you work. The purposes of data processing include contract management, billing and communication.

Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is to fulfill the contract with the company you work for.

h. Applicants

You have the opportunity to apply for a job at Miniatur Wunderland via our website.

As part of the application process, we process data that you provide to us in the course of your application. This includes information about your CV, your previous career and other data that you provide. The data is processed for the following purposes:

• Determining whether employment is possible;
• Initiation of an employment relationship.

Legal basis: Art. 6 (1) (b) GDPR.

• Fulfillment of statutory retention obligations or defense against legal claims.

Legal basis: Art. 6 (1) (c) GDPR.

• Inclusion in our talent pool for later contact if no employment relationship is established for the time being.

Legal basis: Art. 6 (1) (a) GDPR. You can withdraw your consent at any time by sending us an email.

If we are unable to offer you employment, we will retain the application documents you have submitted for up to six months after any rejection for the purpose of answering questions in connection with your application and rejection. This does not apply if statutory provisions prevent deletion, if further storage is necessary for the purpose of providing evidence or if you have expressly consented to longer storage.

We may store your name and contact details that we have received in the course of the application process in order to track who has applied to us in the past. We store this information for 3 years. The legal basis for this data processing is Art. 6 (1) (f) GDPR. Our legitimate interest is to obtain an overview of applications that have already been submitted.

i. Newsletter subscribers and recipients of ticket notifications

You have the option of registering for our newsletter or activating a ticket notification. In doing so, we process your personal data as described below.

1) We process the contact details you provide to us when you register for our newsletter or activate the ticket notification. This is done for these purposes:

• Sending advertising mailings with information and updates on our products, promotions and events for the purpose of promoting sales and acquiring new customers;
• Information about newly available ticket contingents.

Legal basis: Art. 6 (1) (a) GDPR. You can withdraw your consent at any time via the unsubscribe link in every email.

2) We process pseudonymous information about how our newsletter is used (click behavior, opening rate and time, length of stay, interactions with links contained in the newsletter). This serves the following purposes:

• Performance measurement and optimization of our content;
• Personalization of our advertising approach.

Legal basis: Art. 6 (1) (a) GDPR. You can withdraw your consent at any time via the unsubscribe link in every email.

j. Contact persons from the press

We operate a separate area for journalists via the website https://presse.miniatur-wunderland.de/. In doing so, we process the personal data of these persons.

1) We process your name and contact details as well as other information that you provide to us as part of your accreditation. This includes, among other things, information about your employer or the medium for which you work and your planned day of visit. The data processing serves the following purposes:

• Examination and processing of the accreditation application;
• Granting of discounted admission for journalistic purposes;
• Communication with you to clarify requests.

Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is to offer you the opportunity to visit Miniatur Wunderland for journalistic purposes and on special terms.

2) We process your name and contact details that you provide to us when you register for our press mailing list. Data processing is carried out for the following purposes:

• Sending invitations to press events;
• Sending information and updates on our products, promotions and events.

Legal basis: Art. 6 (1) (a) GDPR. Consent can be withdrawn at any time.

3) We process pseudonymous information about the device and browser you are using, server log files, your network connection and your IP address if you visit our press website. The data processing serves the following purposes:

• Ensuring the security, operability and stability of our website, including defense against attacks.

Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is to provide you with secure, attractive and user-friendly websites.

4) We also process information about how you behave on the press website. This includes the IP address and user IDs, some of which are assigned by third-party providers. Data processing is carried out for these purposes:

• Reach measurement and analysis of user behavior to optimize our websites, error analysis;
• (Conversion) tracking for reach measurement.

Legal basis: Art. 6 (1) (a) GDPR. You can withdraw your consent at any time via the cookie consent banner.

k. Social media visitors

We operate company presences on various social media channels. When visiting and interacting with these channels, personal data is processed as follows.

1. Controller of the social media providers

When you visit our social media pages (Facebook, Instagram, TikTok, LinkedIn, XING) on which we present our company, certain information about you as a visitor is processed.

Further information on data processing:

Facebook and Instagram:

• Privacy policy of Meta Platforms Ireland Limited
• Opt-out option

TikTok: Privacy policy of TikTok Technology Limited

XING: Privacy policy of NEW WORK SE.

LinkedIn: Privacy Policy of the LinkedIn Ireland Unlimited Company

Snapchat: Privacy policy of Snap Inc.

X (Twitter): Privacy policy of the Twitter International Unlimited Company

Pinterest: Privacy policy of Pinterest, Inc.

YouTube: Privacy policy of Google Ireland Limited

2. Joint responsibility of the social media providers and Miniatur Wunderland Hamburg GmbH (joint controllers)

Some social media providers collect and process event data and send us anonymized statistics and data for our pages that help us to gain insights into the various activities that visitors carry out on our site (so-called "Page Insights"). These Page Insights are created on the basis of certain information about people who have visited our site(s).

Further information on data processing:

Facebook and Instagram:

• Joint Controller Agreement
• Data subject rights can also be asserted against Meta. Further information on this can be found in the Privacy policy.

TikTok

• Joint Controller Agreement
• Data subject rights can be asserted via this form at TikTok.
• We have agreed with TikTok that the Irish Data Protection Commission is the competent supervisory authority overseeing the processing of Pages Insights. You can lodge your complaint with the Irish Data Protection Commission (see www.data protection.ie) or any other supervisory authority.

XING

• Joint controller agreement
• You can assert your rights as a data subject with XING on this website. You can contact XING's data protection officer using this contact form.

LinkedIn

• Joint Controller Agreement
• Data subject rights can be asserted against LinkedIn via this contact form. You can contact the data protection officer via this link.
• We have agreed with LinkedIn that the Irish Data Protection Commission is the lead supervisory authority overseeing processing for Page Insights. You can lodge your complaint with the Irish Data Protection Commission (see www.dataprotection.ie) or any other supervisory authority.

3. Controller of Miniatur Wunderland Hamburg GmbH

We process information that you have made available to us via our social media channels on the respective social media platform. This information may be the name used, contact information or a message to us.

Legal basis: Legitimate interest pursuant to Art. 6 (1) (f) GDPR in communicating with interested parties and followers.

l. Data subjects in Switzerland

If you are a data subject within the scope of the Swiss Federal Act on Data Protection, the information under this point also applies.

The legal references made in this data protection information are aimed at data subjects in Switzerland in accordance with the comparable provisions of the Federal Act on Data Protection. This applies in particular to the applicable data subject rights under Art. 25-29, 32 DSG.

Data processing also takes place in the following countries outside Switzerland:

• Countries within the EU or EEA.

We guarantee an appropriate level of data protection. This is ensured by

• an established adequate level of data protection pursuant to Art. 16 para. 1 DSG for the recipient country;
• Standard data protection clauses that the FDPIC has previously approved, issued or recognized, in particular the standard contractual clauses of the European Commission;
• an international treaty in which an appropriate level of data protection is regulated.