I. General information about data processing
1. What is personal data?
The term ‘personal data’ is defined in the General Data Protection Regulation (hereinafter: ‘GDPR’). According to this regulation, personal data includes all information that refers to an identified or identifiable natural person. This includes, for example, your given name, your address, phone number or date of birth. Information about your use of this website may also constitute personal data if the information could identify you as a person.Â
2. Extent of the processing of personal data
We only process our users’ personal data to the extent that it is necessary to provide a functional website, its content and our services. The processing of our users’ personal data is only done with the consent of the user or if so permitted by law.Â
3. Legal basis for the processing of personal data
Where we obtain the consent of the data subject for the processing of personal data, Art. 6, Para. 1(a) GDPR serves as the legal basis.
When processing personal data in order to fulfil a contract to which the data subject is a party, Art. 6, Para. 1(b) GDPR serves as the legal basis. This also applies to processing that is required in order to perform pre-contractual measures.
If it is necessary to process personal data in order to fulfil a legal obligation to which our company is subject, Art. 6, Para. 1(c) GDPR serves as the legal basis.
In cases where it is necessary to process personal data in order to protect the vital interests of the data subject or another natural person, Art. 6, Para. 1(d) GDPR serves as the legal basis.
If data processing is necessary in order to protect a legitimate interest of our company or of a third party and if this interest is not superseded by the interests or fundamental rights and freedoms of the data subject, Art. 6, Para. 1(f) GDPR serves as the legal basis.Â
4. Deletion of data and duration of storage
The personal data of the data subject is deleted or blocked as soon as the purpose for its storage ceases to apply. Data may be stored for longer than this period if so stipulated by European or national law in provisions of European Union, laws or other regulations to which the data controller is subject. Data is also blocked or deleted if a deadline specified by one of the above conventions expires, unless it is necessary to continue to save the data in order to conclude or fulfil a contract.
II. Provision of the website and creation of log files
1. Description and extent of data processing
 When you visit our website, the following data is logged:Â
- Browser and version
- Operating system used
- Referrer URL (website previously visited), as well as pages visited on our website
- IP address
- Date and time of server request
- Internet service provider
The data is also saved in the log files on our system. This data is not stored with any other personal data from the data subject.
2. Legal basis for data processing
The legal basis for saving data and log files is Art. 6, Para. 1(f) GDPR.
3. Purpose of the data processing
The temporary storage of the IP address by the system is necessary in order to supply the website to the user’s computer. To do this, the user’s IP address needs to be saved for the duration of the session. Data is saved in log files in order to ensure the proper functioning of the website. It also helps us to optimise the website and ensure the security of our IT systems. The data is not analysed for marketing purposes in this context. These purposes also represent our legitimate interest in data processing in accordance with Art. 6, Para. 1(f) GDPR.
4. Duration of data storage
The data we save is deleted as soon as it is no longer required in order to fulfil the purpose for which it was originally collected. This is the case after seven days at the latest. It may be the case that data is stored for longer than this. In such cases, the user’s IP address is deleted or modified so that they can no longer be assigned to the calling client.
5. Opt-out and requests for deletion
The collection of the data listed is essential in order to be able to operate the website. As a result, there is no opt-out option available to the user.
III. Use of cookies
Our website uses various cookies. Cookies are text files that are stored in the Internet browser or by the Internet browser on the user’s computer system. If a user accesses a website, a cookie may be saved on the user’s operating system. This cookie contains a unique character string that enables the clear identification of the browser if the website is accessed again at a later time.
We use cookies to make our website more user-friendly. Some elements of our website require that the calling browser also be identifiable after visiting another page.Â
The following data is saved and transmitted in cookies, for example:
- Language settings
- Items in a shopping basket
- Log-in details
We also use cookies on our website in order to analyse the user’s browsing habits.Â
As such, the following data may be transmitted, for example:
- Search terms entered
- Frequency of page impressions
- Use of website functions
Analysis and functional cookies are used to improve the quality of our website and its contents and to make it easier for you to use our services on the website. Analysis cookies allow us to learn how the website is used so that we can constantly optimize our offer. So-called marketing cookies are used to display personalized content that matches your interests. We can use it to show you personal offers and information that are particularly relevant to your planned trip.
Insofar as we use cookies for analysis or marketing purposes, we process your data on the basis of your consent in accordance with Art. 6 Paragraph 1 Clause 1 lit. a) DSGVO. In all other cases, the legal basis for the use of cookies is Art. 6 Paragraph 1 Clause 1 lit. f) DSGVO (essential cookies).
You can revoke this consent at any time with effect for the future, in whole or in part. For this and for more information on the individual services, the scope and duration of data storage or to be able to view and manage your consent individually, you can access our consent platform and change your personal settings here.
Furthermore, you can deactivate or restrict the transmission of cookies by changing the settings in your Internet browser. Previously stored cookies can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it is possible that not all functions of the website can be used to their full extent.
IV. Surveys and competitions
1. Description and extent of data processing
If you participate in surveys or competitions, we collect the data required in order to be able to implement the competition or survey. In general, these are an individual competition post (e.g. a comment or photo), as well as a name and contact details. In the case of a competition, it may be necessary that we share your data with third parties involved in the competition in order to issue a prize. Such third parties may include couriers, travel operators or hotels. Data processing and data sharing may vary depending on the competition and is therefore described in detail in the Terms and Conditions for each competition. Participation in the competition and the associated data collection is, of course, voluntary. In the case of surveys, we will generally anonymise your personal data so that this information cannot identify you as a person, unless you have given your express consent for us to process your personal data.
2. Legal basis for data processing
The legal basis for the processing of your data is your consent in accordance with Art. 6, Para. 1(a)Â GDPR.
3. Purpose of the data processing
We only process your data in order to be able to implement the competition and/or survey.Â
4. Duration of data storage
Your data will be deleted after the end of the competition, provided no further storage of the information is required due to a newsletter subscription, for example. We will delete your data once the competition is complete, the prizes have been issued and after any statutory warranty period. In the cases of surveys, your data is generally anonymised.
5. Opt-out and requests for deletion
You may revoke your consent to have your data processed or may file an objection to your data being processed at any time. If the data is required in order to execute a contract or carry out pre-contractual measures, it is only possible to delete the data beforehand if there are no contractual or legal requirements to the contrary.
V. Contact form and email contact
1. Description and extent of data processing
There is a contact form on our website that can be used to contact us electronically. If a user decides to use this form, the data from the input field are sent to us and saved.Â
If you contact us via email or a contact form, the data you share with us (email address, name and phone number) is saved in order to answer your questions and deal with your enquiry.
When the message is sent, the following data is also saved:
- User IP address
- Date and time of registration
Alternatively, you can contact us via the email address provided. In this case, the user’s personal data transmitted with the email is saved. If you provide us with data regarding communication channels (such as email address, phone number), we will only use this information to answer your enquiry.
This information will not be shared with third parties in this context. The data will only be used in order to process the enquiry.
2. Legal basis for data processingÂ
The legal basis for processing data shared when you make contact with us is Art. 6, Para. 1(f) GDPR. If we request information via the contact form that is not essential to our contacting you, such entries are always marked as optional. This information serves to clarify your request and improve the way we handle your enquiry. This information is provided on a solely voluntary basis and with your consent as per Art. 6, Para.1(a) GDPR.
If the purpose of the email contact is to conclude a contract, the additional legal basis for processing the data is Art. 6, Para. 1(b) GDPR.
3. Purpose of the data processing
The processing of personal data from the input field is used solely to process the contact request. In the case of email contact, this also represents a necessary legitimate interest in the data processing.
The other personal data processed while sending the message serve to prevent the misuse of the contact form and to ensure the security of our IT systems.
4. Duration of data storage
The data is deleted as soon as it is no longer required in order to fulfil the purpose for which it was originally collected. For the personal data from the input fields on the contact form and the data sent via email, this is the case once the conversation with the user has ended. The conversation is deemed ended if the circumstances imply that the subject of the enquiry has been conclusively clarified.Â
The other personal data collected while sending the message is deleted after a period of seven days at the latest.
5. Opt-out and requests for deletion
The user may revoke his or her consent to the processing of personal data at any time. If users contact us via email, they may revoke consent to the storage of their personal data at any time. In such cases, the conversation cannot be continued.
All personal data saved during a contact request is deleted in such cases.
VI. Two-click solution for the integration of YouTube
It is our aim to provide you with information via a wide range of media. As a result, we integrate videos from YouTube (YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA). YouTube, LLC is a subsidiary of Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.
YouTube is an online video-sharing platform that makes it possible for people to publish videos for free and for other users to watch, rate and comment on videos, also for free. YouTube permits the publication of all types of videos, which is why entire films and TV shows can be viewed on the site, along with music videos, trailers and videos made by users themselves.
In order to view our videos, users need to click on the preview image. Only once the information box is clicked away or the user logs in can the video be viewed.Â
The integration of YouTube videos also takes place in an expanded data privacy mode, or uses the no-cookie solution. This means that only when a video is played are YouTube cookies and pixel tags placed in order to tailor advertising and search results.
When a YouTube video is played, the following data is sent to Google as the operator of YouTube:
- IP address
- The specific address of the site accessed
- The browser ID transmitted
- System date and time of page visit
- Existing cookies permitting the clear identification of your browser
As the operator of YouTube, Google has sole responsibility for processing this data. More information is available at:Â policies.google.com/privacy.
We would like to inform you that Google may receive other information about cookies previously saved on your computer. We have no influence over how Google may use this information.
You can find the YouTube Data Privacy Policy here:Â https://policies.google.com/privacy?hl=de&gl=de
VII. Data security
We have taken technical and organisational security measures to protect your data that has been processed by us from accidental or deliberate manipulation, loss and destruction, as well as from access by unauthorised parties. We continually improve our security measures based on technological developments.
VIII. Rights of the data subject
If your personal data is processed, you are the data subject within the understanding of GDPR and you have the following rights vis-à -vis the data controller. Â
We would be happy to provide you with information about whether we process your personal data, to what extent and for what purposes (Art. 15 GDPR). Furthermore, where the legal criteria apply, you also have the right to rectification (Art. 16 GDPR), to the restriction of processing (Art. 18 GDPR), to deletion (Art. 17 GDPR) and to data portability (Art. 20, GDPR).
Where the legal criteria apply, you also have the right to object to data processing (Art. 21 GDPR).
If you wish to exercise the rights as above, please email datenschutz@hamburg-tourismus.de or write to our company address. Exercising your rights as above is free of charge.
Without prejudice to these rights or the option to exercise any other administrative or judicial remedy, you have the right at any time to assert your right to appeal to a supervisory authority, particularly in the Member State where you are resident, where you work or where the presumed infringement occurred, if you are of the opinion that your personal data was processed in contravention of data protection regulations (Art. 77 GDPR).
The relevant supervisory authority for our company is: the Hamburg Representative for Data Protection and Freedom of Information.
IX. Changes to the privacy policy
This data privacy policy will be adapted over the course of the development of the Internet and our services. We will publish any amendments on this page in good time. In order to remain up to date regarding the latest status of the provisions regarding our data use, please visit this site regularly.
X. Contact details for Data Protection Officer
External Data Protection Officer of Hamburg Tourismus GmbH:
intersoft consulting services AG
Beim Strohhause 17
20097 Hamburg
Telefon: +49 (0) 40 790 235 235
E-Mail:Â datenschutz@hamburg-tourismus.de
