Privacy Policy

1. Controller

The person responsible for processing within the meaning of the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG) is:

2. Definitions

Personal data

Personal data means any information relating to an identified or identifiable natural person. A natural person is considered identifiable if they can be identified directly or indirectly, in particular by reference to an identifier or additional data.

Processing

Processing means any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Processor

A processor is a natural or legal person, public authority, agency or other body that processes personal data on behalf of the controller.

3. Data processing arising from the contract

What data is processed?

• First and last name
• Address
• Contact details
• Content of your enquiry or booking
• Payment data

Where does this data come from?

We receive this data directly from you in the context of your enquiry and any contractual relationship for the performance of a boat trip or related services. In addition, we may process information you have made publicly available.

For what purpose and on what legal basis is this data processed?

The processing of your personal data is necessary for the performance of the contract with you as our customer in order to provide our services. The legal basis for processing is Art. 6(1)(b) GDPR.

How long is this data stored?

We process and store your personal data for as long as necessary to fulfil our statutory and contractual obligations. Commercial and tax retention periods are between two and ten years. After the retention periods expire, your personal data will be deleted.

4. Data transfer

Where we work with processors, we bind them contractually in accordance with the statutory requirements of Art. 28 GDPR. Your data may be transferred to third parties in individual cases to the following categories of recipients:

• Tax advisors or lawyers
• External accounting firms
• Cooperation partners
• Banks and credit institutions

We transfer your data to external service providers only to the extent necessary to fulfil our contractual and statutory obligations. Your data will not otherwise be transferred to third parties, in particular not to entities outside the European Union or the European Economic Area.

5. Your rights

You have the following rights with regard to the processing of your personal data, which you may exercise at any time informally by contacting the person listed under point 1.

Right of access

On request we will inform you which personal data we hold about you, for what purpose, for how long, from which source and on what legal basis, and whether we have disclosed it to third parties.

Right to rectification

If the personal data we hold about you proves to be inaccurate or incomplete, we will correct or supplement it on request without undue delay.

Right to erasure (right to be forgotten)

You have the right to the immediate erasure of your personal data, provided there are no statutory retention obligations.

Right to restriction of processing

You may request that we restrict the processing of your personal data.

Right to object to processing

You may object to the processing of your personal data at any time. This applies in particular where the legal basis for processing is Art. 6(1)(f) GDPR.

Right to data portability

You have the right to receive the personal data you have provided to us in a universally readable format.

Right to lodge a complaint with a supervisory authority

You also have the right to lodge a complaint with the competent data protection supervisory authority regarding the processing of your personal data by us. The competent authority is the data protection authority of the federal state in which we are based. Further information can be found at www.bfdi.bund.de.

We politely point out that the exercise of your rights may in individual cases be subject to certain conditions.

6. Data security

To ensure the protection and security of your personal data, we implement a range of technical and organisational security measures whose effectiveness we review on a regular basis.