Privacy policy

1. Data protection at a glance

General information

This information gives you a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to identify you personally. You will find detailed information in the following sections of this privacy policy.

Who is responsible for data collection on this website?

The controller responsible for data processing on this website is Paganini Eventmarketing GmbH as the organizer of the Halberstadt Christmas Market on the Fischmarkt and Holzmarkt. You will find the contact details in the section “Information on the controller” and in the legal notice.

How do we collect your data?

This website is primarily an information service. There is no registration, no newsletter and no shop. When you access the site, only technical data is collected automatically by our hosting provider (e.g. IP address, browser, operating system, time of access). We only receive further data if you contact us yourself by email or phone, apply to us via the application form or by email, or send an inquiry using the Christmas party form (see section 4).

What do we use your data for?

The technical data is used exclusively to provide the website securely and without errors. Your usage behavior is not analyzed.

Cookies, tracking and analytics

This website sets no cookies and uses no analytics, tracking or advertising services. No social media plugins, maps, videos or other third-party content are embedded. This is why no cookie banner is displayed. The language switch (DE/EN) consists of simple links and does not store anything on your device.

What rights do you have regarding your data?

You have the right at any time to receive information free of charge about the origin, recipients and purpose of your stored personal data. You also have the right to request the correction or deletion of this data, to object to its processing and to lodge a complaint with the competent supervisory authority. Details can be found in section 3.

2. Hosting

Netlify

We host this website with Netlify, Inc., 101 2nd Street, San Francisco, CA 94105, USA (“Netlify”). When you visit our website, your access data (see section 4 “Server log files”) is processed on Netlify's servers. Netlify operates a worldwide server network (content delivery network). Content is usually delivered via a server near you; processing in the USA cannot be ruled out.

Netlify is used on the basis of Art. 6 (1) (f) GDPR. Our legitimate interest lies in providing our website reliably, quickly and securely.

Transfer to third countries

Netlify is certified under the EU-U.S. Data Privacy Framework (DPF). The DPF is an agreement between the European Union and the USA intended to ensure compliance with European data protection standards for data processing in the USA; for certified companies, the EU Commission has determined an adequate level of data protection (Art. 45 GDPR). The transfer takes place on this basis. Should the DPF become invalid, the EU Commission's standard contractual clauses (Art. 46 (2) (c) GDPR) have been agreed as the basis in our contract with Netlify.

Data processing agreement

We have concluded a data processing agreement with Netlify pursuant to Art. 28 GDPR. This ensures that Netlify processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

3. General information and mandatory information

Data protection

We take the protection of your personal data very seriously and treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy. Please note that data transmission over the internet (e.g. when communicating by email) may have security gaps. Complete protection of data against access by third parties is not possible.

Information on the controller

The controller responsible for data processing on this website is:

Paganini Eventmarketing GmbH
Sudenburger Wuhne 29-30
39112 Magdeburg
Germany
represented by its Managing Director Daniel Ziegler

Phone: +49 391 5418923
Email: halberstadt@paganini.tv

The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

Data protection officer

We have not appointed a data protection officer. If you have any questions about data protection, please contact us at any time using the contact details above.

Storage period

Unless a more specific storage period is stated in this privacy policy, your personal data will remain with us until the purpose for which it was processed no longer applies. If you assert a justified request for deletion or withdraw your consent, your data will be deleted unless we have other legally permissible reasons for storing it (e.g. retention periods under tax or commercial law, usually six or ten years). In the latter case, the data will be deleted once these reasons no longer apply.

Legal bases for data processing

We only process personal data if one of the following legal bases applies: your consent (Art. 6 (1) (a) GDPR), the performance of a contract or the implementation of pre-contractual measures (Art. 6 (1) (b) GDPR), compliance with a legal obligation (Art. 6 (1) (c) GDPR) or our legitimate interest (Art. 6 (1) (f) GDPR). We explain which legal basis applies in each individual case in the respective sections of this privacy policy. As this website uses neither cookies nor any other storage on your device that is not strictly technically necessary, no consent pursuant to Section 25 (1) TDDDG (German Telecommunications and Digital Services Data Protection Act) is required.

Recipients of personal data

We only pass on personal data to external parties if this is necessary to provide the website (hosting and form processing by Netlify as a processor, see sections 2 and 4; spam checking of form entries by Automattic, see section 4), if we are legally obliged to do so (e.g. disclosure to authorities) or if you have given your consent. Your data will not be sold or passed on for advertising purposes.

Withdrawal of your consent to data processing

Where processing is based on your consent, you can withdraw it at any time with effect for the future. The lawfulness of the processing carried out until the withdrawal remains unaffected.

Right to object to data collection in special cases and to direct marketing (Art. 21 GDPR)

If data processing is based on Art. 6 (1) (e) or (f) GDPR, you have the right to object to the processing of your personal data at any time on grounds relating to your particular situation; this also applies to profiling based on these provisions. If you object, we will no longer process your personal data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims (Art. 21 (1) GDPR).

If your personal data is processed for direct marketing purposes, you have the right to object to this processing at any time (Art. 21 (2) GDPR). We do not carry out direct marketing via this website.

Right to lodge a complaint with the competent supervisory authority

In the event of breaches of the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR). This right exists without prejudice to any other administrative or judicial remedies. The authority responsible for us is:

Der Landesbeauftragte für den Datenschutz Sachsen-Anhalt (State Commissioner for Data Protection of Saxony-Anhalt)
Otto-von-Guericke-Straße 34a
39104 Magdeburg
Germany

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in fulfilment of a contract handed over to you or to a third party in a common, machine-readable format (Art. 20 GDPR). If you request the direct transfer to another controller, this will only be done insofar as it is technically feasible.

Access, correction and deletion

Within the framework of the applicable legal provisions, you have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of the data processing (Art. 15 GDPR) and, if applicable, a right to correction (Art. 16 GDPR) or deletion (Art. 17 GDPR) of this data. You can contact us at any time about this and any other questions regarding personal data.

Right to restriction of processing

You have the right to request the restriction of the processing of your personal data (Art. 18 GDPR). This right exists in particular

• if you dispute the accuracy of your data stored by us, for the duration of the verification,
• if the processing is unlawful and you request restriction instead of deletion,
• if we no longer need your data but you need it to exercise, defend or assert legal claims,
• if you have lodged an objection pursuant to Art. 21 (1) GDPR, as long as it has not yet been determined whose interests prevail.

If processing has been restricted, this data – apart from its storage – may only be processed with your consent or for the establishment, exercise or defense of legal claims, for the protection of the rights of another person or for reasons of important public interest.

SSL/TLS encryption

For security reasons and to protect the transmission of content, this site uses SSL/TLS encryption. You can recognize an encrypted connection by the fact that the browser's address bar begins with “https://” and a padlock symbol is displayed. When encryption is activated, the data you transmit to us cannot be read by third parties.

Objection to advertising emails

We hereby object to the use of the contact details published in our legal notice for sending unsolicited advertising and information material. We expressly reserve the right to take legal action in the event of unsolicited advertising, for example through spam emails.

Obligation to provide data and automated decision-making

You are neither legally nor contractually obliged to provide us with personal data. However, the website cannot be displayed without the technical access data mentioned in section 4. Automated decision-making including profiling (Art. 22 GDPR) does not take place.

4. Data collection on this website

Cookies and local storage

This website does not use cookies and does not store any other information on your device (for example in local storage). There is no tracking, neither by us nor by third parties.

Server log files

The provider of the site (Netlify, see section 2) automatically collects and stores information in so-called server log files, which your browser transmits automatically. These are:

• IP address of the requesting device
• date and time of the server request
• page or file accessed and amount of data transferred
• referrer URL (the previously visited page)
• browser type and browser version
• operating system used
• HTTP status code of the request

This data is not merged with other data sources. The data is collected on the basis of Art. 6 (1) (f) GDPR. We have a legitimate interest in the technically error-free presentation and security of our website (e.g. detecting and fending off attacks); for this purpose, the server log files must be recorded. The log files are automatically deleted after a short time unless their further retention is required for evidence purposes in individual cases.

Inquiry form for Christmas parties

Using the form in the “Christmas party” section, you can send us a non-binding inquiry including the number of people and the calculated total price. In doing so, we process the data you enter: name or contact person, for companies also company name and company address (street, house number, postal code, town), email address, optionally phone number, preferred date and message, as well as the type of inquiry (company/private individual) and number of people. The price calculation itself takes place exclusively in your browser; data is only transmitted when you submit the form.

The purpose is to process your inquiry and to prepare an individual offer. The legal basis is Art. 6 (1) (b) GDPR (pre-contractual measures at your request).

For the technical processing, we use the “Netlify Forms” function of our hosting provider Netlify, Inc. (see section 2, including the data processing agreement and third-country transfer). Your inquiry is stored with Netlify and forwarded by email to our mailbox halberstadt@paganini.tv. To detect and prevent spam, form entries (including email and IP address) are automatically checked against the Akismet service of Automattic Inc., 60 29th Street #343, San Francisco, CA 94110, USA, and transferred to the USA for this purpose. Automattic is certified under the EU-U.S. Data Privacy Framework (adequacy decision, Art. 45 GDPR). The legal basis for the spam check is our legitimate interest in a functioning form free of abuse (Art. 6 (1) (f) GDPR).

Netlify stores the information submitted via the form until we delete it. We delete it once a year on December 31, so that no submission is stored for longer than one calendar year; we will also delete it earlier on request. If a booking is made, we store the data required for processing the contract within the statutory retention periods. Your name and email address (and, for companies, also the company name and company address for the offer) are required so that we can answer your inquiry; all other information is voluntary.

Applications via the “Jobs” form

Using the form in the “Jobs” section, you can apply for a job at the Halberstadt Christmas Market. In doing so, we process the following information: desired type of employment (full-time, part-time, mini-job, working student), preferred working hours, first name, last name, age, email address and phone number, plus an optional message with further information. Apart from the message, all information is required to process the application.

The purpose is to carry out the application process and to decide on establishing an employment relationship with Paganini Eventmarketing GmbH. The legal basis is Art. 6 (1) (b) GDPR (initiation of a contractual relationship at your request). We ask for your age in order to comply with the German Youth Employment Protection Act (Jugendarbeitsschutzgesetz), e.g. regarding minimum age and working hours; in this respect, the legal basis is additionally Art. 6 (1) (c) GDPR. Please do not send us any special categories of personal data (e.g. information about your health or religion). Your information will only be made available to the persons involved in the selection process and will not be passed on to third parties.

For the technical processing, we use “Netlify Forms” of our hosting provider Netlify, Inc. (see section 2, including the data processing agreement and third-country transfer). Your application is stored with Netlify and forwarded by email to our mailbox weihnachtsmarkt@paganini.tv. To detect and prevent spam, entries (including email and IP address) are automatically checked against the Akismet service of Automattic Inc. (see “Inquiry form for Christmas parties”). The form does not set cookies and does not store anything on your device.

If you are hired, the necessary data will be transferred to your personnel file. Otherwise, we will delete your application data no later than six months after the end of the application process; in addition, we delete the submissions at Netlify once a year on December 31. The six-month period serves to defend against possible claims under the German General Equal Treatment Act (AGG); the legal basis for this is our legitimate interest (Art. 6 (1) (f) GDPR). Longer storage will only take place with your express consent (Art. 6 (1) (a) GDPR), which you can withdraw at any time. Applications you send us by email instead are treated in the same way.

Inquiries by email or phone

The email and phone links on this website merely open your own email or phone program; clicking them does not in itself transmit any data to us.

If you contact us by email or phone, your inquiry including all resulting personal data (name, inquiry, email address or phone number if applicable) will be stored and processed by us for the purpose of handling your request. We will not pass this data on without your consent.

The processing is based on Art. 6 (1) (b) GDPR if your inquiry is related to the performance of a contract or is necessary for the implementation of pre-contractual measures (e.g. an inquiry as a trader or exhibitor). In all other cases, the processing is based on our legitimate interest in the effective handling of the inquiries addressed to us (Art. 6 (1) (f) GDPR).

The data you send us via contact inquiries will remain with us until you ask us to delete it, withdraw your consent to storage or the purpose for storing the data no longer applies (e.g. after your request has been dealt with). Mandatory statutory provisions, in particular statutory retention periods, remain unaffected.

5. Fonts and external links

Locally hosted fonts

For a uniform appearance, this site uses the “Nunito Sans” font. It is stored locally on our server and delivered from there. No connection to servers of Google (Google Fonts) or other third parties is established.

Site map

The site map in the “Getting here” section is our own simplified graphic, loaded directly from our server. It is based on map data from OpenStreetMap (© OpenStreetMap contributors, ODbL license). When the site map is displayed, no data is transmitted to OpenStreetMap or other map services.

Route planning and links to map services

Using the “Start route” button on the site map and the links “Open in Google Maps” and “Open in OpenStreetMap”, you can display the route to the Christmas market. Depending on your device, this opens Apple Maps (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland), Google Maps (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), OpenStreetMap (OpenStreetMap Foundation, St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom) or – on Android devices – a navigation app of your choice installed on the device.

These are simple links, not embedded maps: no data is transmitted to these services when you access our website. Only when you click or tap such a link do you leave our website or does the respective app open; the destination (the location of the market) is passed on to the respective service. From this point on, only its privacy policy applies, over which we have no influence. The same applies to all other links to external websites.

Links to other websites

In the footer of this website, we link to the websites of other Christmas markets run by Paganini Eventmarketing GmbH (advent-in-der-moelle.de, historischer-weihnachtsmarkt-magdeburg.de) and to our company website paganini.tv. These are also simple links: no data is transmitted to the linked websites when you access this page. Only when you click a link does the respective website open in a new window or tab. Its own privacy policy applies there.

Validity of this privacy policy

We adapt this privacy policy as soon as the functions of the website or the legal requirements change. The version published here applies.

Last updated: October 20, 2026