1. General information
The Tourismus-Agentur Schleswig-Holstein GmbH, Wall 55, 24103 Kiel, is the controller responsible for data processing on this website as defined in the European General Data Protection Regulation (GDPR). We respect your personal rights. We understand the importance of the personal information we receive from you as a user of this website. We respect the privacy of your personal data and will collect, store or process all data obtained exclusively in accordance with the relevant data protection regulations within the scope of our business purpose.
Personal data is any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier, such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person.
3. Legal basis for the processing
If and to the extent that we obtain your consent for the processing of personal data, Article 6 (1) sentence 1 (a) of the European Data Protection Ordinance (GDPR) serves as the legal basis.
The processing of personal data required for the fulfilment of a contract with you is based on Article 6 .(1) clause 1 (b) GDPR. This also applies to processing operations that are necessary for carrying out pre-contractual measures.
Where the processing of personal data is required for the compliance with a legal obligation to which our company is subject, Article 6 (1) clause 1 (c) GDPR serves as the legal basis for the data processing.
If the processing is required to protect a legitimate interest of our company or a third party and if the interests, fundamental rights and freedoms of the data subject do not override this legitimate interest, Art. 6 (1) clause 1 (f) GDPR serves as the legal basis for the data processing. As a rule, the legitimate interest of our company lies in the performance of our business activities.
4. Data erasure and storage time
The personal data is erased or blocked as soon as the purpose of the storage ceases to apply. The data can also be stored where this has been provided for by the European or national legislature in EU regulations, laws or other provisions. The data can also be blocked or deleted when a storage period prescribed by the aforementioned standards expires, unless there is a requirement for the continued storage of the data to conclude or perform a contract.
5. Collection of personal data
In principle, we do not collect or use any personal data when you visit our website. This only happens if it is necessary to provide a functional website as well as our content and services. The collection and use of personal data of our users takes place routinely only after their consent. This does not apply in cases where prior consent cannot be obtained for factual reasons and where processing of the data is permitted by law.
In the following we would like to inform you about the type, scope and purpose of our data handling within the scope of this website:
5.1 Server log files
Every time you visit our website, the user's access data required for use and billing purposes are stored on our server in a log file which your browser automatically transmits to us.
• Browser type/ browser version
• Operating system used
• Referrer URL
• Date and time of the server request
• IP address of the computer requesting the website;
• Accessed documents;
The log file is stored for the following purposes:
• Analysis of file retrieval for statistical purposes;
• To deliver the contents of the website correctly;
• Checking for non-contractual or otherwise illegal use, provided that there are actual indications for this.
Those data cannot be associated with individual persons. We do not merge those data with other data sources.
After the user logs on to our website, so-called "cookies" are stored on the user's computer.
A cookie is a small text file in a designated directory on your computer. This file is used to identify the user's computer for the duration of the session. Cookies cannot generate any manipulations at the respective end device of the user and can be deleted manually at any time, most easily in the browser.
Processing of the data by cookies is necessary for the purposes specified in order to protect our legitimate interests as well as those of third parties, where applicable, in accordance with Art. 6 Para. 1 Sentence 1 (f) GDPR.
5.3 User data
We collect and use your personal data to the extent necessary to enable you to use the services we provide.
If pseudonyms are used, we may create user profiles for the purposes of advertising, market research and a user-friendly design of our Internet service.
You are entitled to object to this use of your data at any time. We are not permitted to combine the user profiles with data about the bearer of the pseudonym.
5.4 Data in connection with your contact
If you send us your enquiries by filling out the contact form, your details from the form or e-mail address provided will be stored solely for processing the respective enquiry and to enable us to address any follow-up questions. We will not pass on this data to third parties without your consent.
5.5 Use of Google Analytics
Our website uses Google Analytics, a web analysis service of Google LLC ("Google"), 1600 Amphitheatre Parkway Mountain View, CA 94043, USA.
Google Analytics uses so-called "cookies", text files that are stored on your computer and facilitate analysis of your use of the website. The information generated by the cookie regarding your use of this website is, as a rule, transmitted to and stored on a Google server in the USA. However, if the IP anonymisation is activated on this website, your IP address is first abbreviated by Google in the member states of the European Union or in other member states of the EEA (European Economic Area) Agreement. Your full IP address will be transmitted to a Google server in the USA and truncated there only in exceptional cases. Google will use this information on behalf of this website’s operator to evaluate your use of this website, to create reports about the website activities, and to provide additional services connected with the website and Internet use to the website operator. The IP address transmitted from your browser as part of Google Analytics is not associated with any other data held by Google. You can prevent cookie storage by selecting the appropriate settings in your browser; however, we would like to point out that in such cases you might not be able to use all of the functionality of this website. In addition, you may prevent the transmission of the data created by the cookie related to your use of this website (including your IP address) to Google, and the processing of this data by Google, by downloading and installing the browser plug-in available under the following link: http://tools.google.com/dlpage/gaoptout?hl=de. An opt-out cookie is set that will prevent your data being registered when you visit this website in future.
We instruct you that the code "anonymizeIp" has been added to Google Analytics on our website to guarantee anonymised registration of IP addresses (so-called IP masking). We use Google Analytics exclusively to evaluate data from double-click cookies and also AdWords for statistical purposes. If you do not want this, you can disable it using the Ads Preferences Manager (http://www.google.com/ settings/ads/onweb/?hl=de).
5.6 Use of Twitter
Our website uses the functions of Twitter Inc. 795 Folsom St., Suite 600, San Francisco, CA 94107, USA.
By using Twitter and the "Re-Tweet" function, the websites that you visit will be linked to your Twitter account and made public to other users. Data is also transmitted to Twitter in this way.
Please note that as the provider of this website we have no knowledge of the contents of the data transmitted nor of its use by Twitter.
You can change your privacy protection settings for Twitter in your account settings at http://twitter.com/account/settings.
For more information on this, please see Twitter's Privacy Statement at http://twitter.com/privacy.
5.7 Use and application of Instagram
The data controller has integrated components of the Instagram service on this website. Instagram is a service that is classified as an audiovisual platform and enables users to share photos and videos and to disseminate such content on other social networks.
The company operating the Instagram services is Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2 Ireland.
Each time one of the individual pages of this website, which is operated by the data controller and which has an integrated Instagram component (Insta-button) is accessed, this component causes the Internet browser being used on the data subject’s IT system to download a corresponding representation of the Instagram component. This process also informs Instagram about the specific subpages of our website that the data subject has visited.
If the data subject is also logged into Instagram at the same time, Instagram detects the specific subpages of our website that the data subject visits each time the data subject accesses our website and does so for the entire duration of the visit to our website. This information is collected by the Instagram component and assigned by Instagram to the data subject’s specific Instagram account. If the data subject clicks on one of the Instagram buttons integrated on our website, the resulting transmitted data and information is assigned to the data subject’s personal Instagram user account and is stored and processed by Instagram.
The Instagram component always provides Instagram with information that the data subject has visited our website, if the data subject is also logged into Instagram when accessing our website; this happens regardless of whether the data subject clicks on the Instagram component or not. If a data subject wishes to prevent this information being transmitted to Instagram, this can be prevented by logging out of Instagram before accessing our website.
5.8 Use of YouTube-Plugins
This website uses the plugin feature of the YouTube platform of Google Inc. "("Google"), San Bruno/California, USA.
Every time you visit our website, a connection to YouTube's servers is established. The YouTube server will be informed of your visit to our website. To our knowledge, personal data will not be stored. However, if you are logged into your YouTube account, you would allow YouTube to associate your browser history directly with your personal profile.
You have the option of deactivating this assignment if you log out of your account beforehand.
For more information on this, please see Twitter's Privacy Statement at https://www.youtube.de/t/privacy.
5.9 Use of Vimeo-Plugins
We use components from Vimeo on this website. Vimeo is a service from Vimeo LLC, 555 West 18th Street, New York, New York, 10011, USA. Every time a website is called up on which the Vimeo service is installed, the service used on that website causes your browser to download a certain specific file from Vimeo. If you visit our website and while doing so you are logged into Vimeo with your user account, Vimeo uses the information collected by the service installed on that website to recognise which specific site you are visiting and allocates this information to your personal account with Vimeo if you have one. The information that you have visited our website is also relayed to Vimeo. This happens irrespective of whether you use relevant Vimeo functions on our website.
If you wish to prevent data about you and your behaviour on our website being sent to and stored by Vimeo, you must log out of Vimeo before you visit our site. Here you can find Vimeo’s data protection policy, in particular regarding its collection and use of data: https://vimeo.com/privacy
We use Vimeo functions to promote an attractive and user-friendly display of our website, based on a legitimate interest as defined by Art. 6 (1) p. 1 (f) GDPR.
5.10 Use of Facebook Plugins
Our website uses plugins from the social network Facebook, Facebook Inc, 1 Hacker Way, Menlo Park, California 94025, USA.
You can recognise the Facebook plugins by the Facebook logo on our website. For an overview of Facebook plug-ins, please see here: http://developers.facebook.com/docs/plugins/.
When you visit our website that contains a social plugin, your browser establishes a direct connection to the Facebook servers. This enables Facebook to receive information that you have visited our website from your IP address. If you are logged onto your Facebook account when you click on the Facebook "Like button", you can link the contents of our website to your Facebook profile. This allows Facebook to associate visits to our website with your user account.
Please note that as the provider of this website we have no knowledge of the content of the data transmitted nor of their use by Facebook. If you do not wish Facebook to be able to associate your visit to our website to your Facebook user account, please log out of your Facebook user account.
For more information on this, please see Facebook's Privacy Statement at http://de-de.facebook.com/policy.php.
We use the so-called double opt-in process to register you for our newsletter. This means that after your registration we will send you an e-mail to the specified e-mail address in which we will ask you to confirm that you wish to receive the newsletter. If you do not confirm your registration within 24 hours, your information will be blocked and automatically deleted after one month. In addition, we store the IP addresses you use and the dates of registration and confirmation. The purpose of the process is to prove your registration and, if necessary, to detect any possible misuse of your personal data.
Your e-mail address is the only mandatory information for sending the newsletter. The disclosure of further, separately marked data is voluntary and shall be used to address you in person. After your confirmation we save your e-mail address only for the purpose of sending you the newsletter. The legal basis is Art. 6 Para. 1 p. 1 lit. a GDPR.
6. Your rights
As far as we process your personal data on our website, you are a "data subject" as defined in the GDPR. You have the following rights vis-à-vis our company:
6.1 Right of access
You can request us to confirm whether we are processing your personal data. If this is the case, you can request the following information from us:
- the purposes for which the personal data is being processed;
- the categories of personal data that is being processed;
- the recipients or categories of recipient to whom your personal data has been or will be disclosed;
- the envisaged period for which your personal data will be stored, or, if not possible, the criteria used to determine that period;
- the existence of the right to lodge a complaint with a supervisory authority;
- any available information regarding the origin of the data, where the personal data is not collected from you;
- the existence of automated decision-making, including profiling, in accordance with Art. 22 (1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you.
Furthermore, you have the right to request information on whether your personal data is transferred to a third country or to an international organisation. In this context, you can request to be informed about the appropriate safeguards in accordance with Art. 46 GDPR in connection with the transfer.
6.2 Right to rectification
You have the right to correct and/or complete your personal data if your processed data is incorrect or incomplete. If this is the case we will make the correction immediately.
6.3 Right to restriction of processing
You have the right to demand the restriction of the processing of your personal data if:
- you are contesting the accuracy of your personal data for a period enabling us to verify the accuracy of the data;
- the processing is unlawful, and you oppose the erasure of your personal data and request the restriction of their use instead;
- we no longer require your personal data for the purposes of the processing, however, you require the personal data for the establishment, exercise or defence of legal claims, or
- you have objected to the processing in accordance with Art. 21(1) GDPR and it has not yet been determined whether our legitimate grounds override your grounds.
Have you requested that the processing of your personal data be restricted, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or of a Member State. You will be informed by us before the restriction is lifted.
6.4 Right to erasure
You can ask us to erase your personal data without undue delay. We are obligated to erase the data without undue delay if one of the following reasons applies:
- Your personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed.
- You withdraw any existing consent on which the processing was based according to Art. 6 (1) clause 1 (a) or Art. 9 (2) (a) GDPR, and there is no other legal ground for the processing.
- You file an objection against the processing pursuant to Art. 21 (1) GDPR and there are no overriding legitimate reasons for the processing.
- In accordance with Art. 21 (2) GDPR, you file an objection against the processing by means of direct marketing.
- Your personal data has been unlawfully processed.
- Your personal data must be erased for compliance with a legal obligation in accordance with EU law or the law of a Member State to which we are subject.
- Your personal data has been collected in relation to the offer of information society services referred to in Art. 8 (1) GDPR.
If we have published your personal data and are obligated to erase it in accordance with Art. 17 (1) GDPR, we shall take appropriate measures - considering the available technology and the implementation costs - to inform the controller(s) responsible for data processing that you have requested the erasure by such controllers of any links to, or copy or replication of such personal data.
Your right to erasure does not apply where processing is required
- for exercising the right to freedom of expression and information;
- for compliance with a legal obligation which requires processing by EU law or Member State law to which we are subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in us;
- for reasons of public interest in the area of public health in accordance with Art. 9 (2) (h) and (i) as well as Art. 9 (3) GDPR;
- for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Art. 89 (1) GDPR insofar as the right referred to in para 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
- or the establishment, exercise or defence of legal claims.
6.5 Right to information
If you have exercised the right to rectification, erasure or restriction of processing against us, we are obligated to notify all recipients to whom your personal data has been disclosed, of the rectification or erasure of the data or restriction of processing, unless this proves impossible or involves disproportionate effort.
You have the right to be informed about the recipients.
6.6 Right to data portability
You have the right to receive your personal data which you may have provided to us, in a structured, commonly used and machine-readable format. You also have the right to transmit such data to another controller without hindrance from us, if
- The processing is based on a declaration of consent in accordance with Art. 6 (1) clause 1 (a) GDPR or Art. 9 (2) (a) GDPR or on a contract in accordance with Art. 6 (1) clause 1 (b) GDPR and
- the processing is carried out using automated methods.
In addition, you have the right to request the transfer of your personal data directly from us to another controller, insofar as this is technically feasible. This should not impair other people's freedoms or rights.
The right to data portability does not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.
We currently do not assume that the data which are subject to the right to data transferability will be processed within the scope of our website offer.
6.7 Right to object
You have the right to object, on grounds relating to your particular situation, at any time to processing of your personal data which is based on Art. 6 (1) clause 1 (e) or (f) GDPR, including profiling based on these provisions.
We shall no longer process your personal data unless we can demonstrate compelling legitimate grounds worthy of protection for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
If your personal data are processed for the purpose of direct marketing, you have the right to object at any time to the processing of the personal data concerning you for such purposes; this also applies to any related profiling.
If you object to the processing for direct marketing purposes, your personal data shall no longer be processed for these purposes.
In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you have the option to exercise your right to object by automated means using technical specifications.
6.8 Right to revoke the declaration of consent under data protection law
You are entitled to revoke your declaration of consent under data protection law at any time. Revoking your consent will not affect the legality of any processing that took place before the revocation.
6.9 Automated individual decision-making including profiling
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. We do not carry out such processing.
6.10 Right of lodge a complaint with a supervisory authority
You are entitled to appeal to a supervisory authority, without prejudice to any other rights of appeal, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of your personal data infringes the GDPR.
7. Responsibility for linked content
8. Disclosure of personal data to third parties
9. Data security
To protect your personal data, we have taken technical and organisational measures to ensure that your data is protected against accidental or intentional loss, destruction or tampering as well as access by unauthorised persons. Our protective measures are reviewed at regular intervals and adapted to technical progress if necessary.
10. Data Protection Officer
Should you have any further queries regarding the processing of your personal data, please contact our company's Data Protection Officer: compolicy GmbH, Schwedenkai 1, 24103 Kiel, Tel.: +49 (0) 431 9089480, E-Mail: firstname.lastname@example.org
As of: May 2020