Campings
Welcome to Albatross Reisen GmbH and our online presence, in particular www.albatross-reisen.de.
We are delighted that you have taken an interest in our offers. Protecting your privacy and your personal data is very important to us. We therefore always collect and use your data in accordance with the provisions of the General Data Protection Regulation (EU) 2016/679 (GDPR), the German Federal Data Protection Act (BDSG), the German Act on Data Protection and Privacy in Telecommunications and Digital Services (TDDDG) and the German Digital Services Act (DDG).
Below, we – as the controller responsible for data processing – inform you about which data we collect and how we process it.
1. Personal Data
Personal data within the meaning of Art. 4(1) GDPR means any information relating to an identified or identifiable natural person.
An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Personal data is stored only insofar as this is necessary to provide the service you have booked, to comply with legal requirements or for the purpose stated below.
2. Controller Responsible for Data Processing
The controller responsible for this online presence within the meaning of the General Data Protection Regulation, other national data protection laws of the Member States and other provisions relating to data protection is:
Albatross Reisen GmbH
Marktbreiter Straße 11
97199 Ochsenfurt
The operation of our Facebook fan page constitutes processing under joint controllership pursuant to Art. 26 GDPR.
We ourselves have no influence on the processing of data by Facebook. Facebook assumes responsibility for the processing of the so-called Insights data and for fulfilling the corresponding obligations under the GDPR. Further information is available at:
https://www.facebook.com/legal/terms/page_controller_addendum sowie unter:
https://www.facebook.com/privacy/policy/?locale=de_DE
3. Purpose of Collecting Personal Data
a) However, the collection of personal data becomes essential if you wish to book a trip or other service via our portal, contact us, subscribe to our newsletter or use other offers on our site for the handling of which personal data is indispensable. This also includes voucher purchases as well as participation in prize draws. If you book a stay or other service, the data collected in the process is used for the handling of this booking and – within the limits of the statutory requirements – for advertising and statistical purposes.
b) In accordance with the statutory provisions and in the interest of data minimization, only such data is collected as is required for providing the specific service concerned. Where we request further information in our forms, providing it is always voluntary and marked as such.
c) The temporary storage of the IP address by the system is necessary to enable the website to be delivered to the user’s computer. For this purpose, the user’s IP address must remain stored for the duration of the session. In addition, data is stored in log files to ensure the functionality of the website. The data also serves us to optimise the website and to ensure the security of our information technology systems. The data is not evaluated for marketing purposes in this context. These purposes also constitute our legitimate interest in data processing pursuant to Art. 6(1)(f) GDPR. The data is likewise stored in the log files of our system. This does not affect the users’ IP addresses or other data that would allow the data to be attributed to a user. This data is not stored together with other personal data of the user.
d) If you book a stay or another service, the data collected in the process is used for the handling of this booking, within the limits of the statutory requirements, for advertising purposes and for statistical purposes.
e) If you send us enquiries via the contact form, your details from the enquiry form, including the contact details you provided there, will be stored by us for the purpose of processing the enquiry and in case of follow-up questions. We do not pass on this data without your consent.
This data is processed based on Art. 6(1)(b) GDPR if your enquiry is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective handling of enquiries addressed to us (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR) if such consent has been requested; consent can be withdrawn at any time.
An informal notice by e-mail to us is sufficient for this purpose. The lawfulness of the data processing carried out up to the withdrawal remains unaffected by the withdrawal.
The data you enter in the contact form remains with us until you ask us to delete it, withdraw your consent to its storage or the purpose for the data storage ceases to apply (e.g. after your enquiry has been fully processed). Mandatory statutory provisions – in particular retention periods – remain unaffected.
f) If you subscribe to our newsletter, we additionally store and use, on the basis of Art. 6(1)(f) GDPR, the data about you and your stay that you provided when booking, in order to be able to look after you as a newsletter subscriber in the best possible way.
g) The legal basis for processing the data after the user has registered for the newsletter is, where the user has given consent, Art. 6(1)(a) GDPR. We otherwise use the personal data we store to maintain customer relationships, for customer care (e.g. information on the course of your stay), to carry out our own advertising and marketing measures (e.g. sending catalogues and other promotional mailings within the limits permitted by law, enquiries about customer satisfaction) and for order processing. The legal basis for sending the newsletter following the sale of goods or services is Section 7(3) of the German Unfair Competition Act (UWG).
4. Legal Basis for the Processing of Personal Data
a) Where we obtain the consent of the data subject for processing operations involving personal data, Art. 6(1)(a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis. The lawfulness of the processing is established by your consent.
You can withdraw any consent you have given at any time. Please note that the withdrawal takes effect for the future and does not affect processing that took place before the withdrawal.
b) Where the processing of personal data is necessary for the performance of a contract to which the data subject is party, Art. 6(1)(b) GDPR serves as the legal basis. This also applies to processing operations that are necessary for the implementation of pre-contractual measures.
c) Where the processing of personal data is necessary for compliance with a legal obligation to which our company is subject, Art. 6(1)(c) GDPR serves as the legal basis.
d) Where vital interests of the data subject or of another natural person make the processing of personal data necessary, Art. 6(1)(d) GDPR serves as the legal basis.
e) Where the processing is necessary for the purposes of a legitimate interest of our company or of a third party and the interests, fundamental rights and freedoms of the data subject do not override the first-mentioned interest, Art. 6(1)(f) GDPR serves as the legal basis for the processing.
This applies in particular to the following groups of cases:
f) Through your use of social media companies, usage profiles are created based on your usage behaviour and used for the delivery of advertisements. For this purpose, cookies are usually stored on your computer. Where the processing is necessary for the purposes of a legitimate interest of our company or of a third party and the interests, fundamental rights and freedoms of the data subject do not override the first-mentioned interest, Art. 6(1)(f) GDPR serves as the legal basis for the processing.
5. Disclosure of Personal Data to Third Parties
Your personal data is disclosed exclusively within the framework of the applicable requirements, in particular those of data protection and competition law.
Where necessary for the provision of the contractual services we owe or for compliance with legal obligations, your data is also disclosed to subcontractors or service providers who provide the service on our behalf or on our instructions (e.g. technical handling of postal and e-mail dispatch, payment processing, customer service).
In addition, data is disclosed to persons or companies for the handling of your booking, in particular to accommodation providers, booking partners, service providers, insurers, airlines, tour operators, hotels, travel agencies, car rental companies, cruise lines, authorities, etc. Please note that the data protection provisions at the registered offices of these persons and companies may differ from those in Germany.
Your data will also be disclosed and transmitted to third parties where we are obliged to do so by law or on the basis of a final and binding court decision.
You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from the controller to whom the personal data was provided.
6. Transfer of Data to a Third Country or an International Organisation
Data is transferred to third countries (countries outside the European Economic Area – EEA) only insofar as this is necessary for the performance of our offers, required by law or you have given us your consent. Where required by law, we will inform you of the details.
Where data is transferred from our reservation system hosted in the EU to a third country for support purposes, this is safeguarded by appropriate safeguards pursuant to Art. 46 GDPR (in particular by the agreement of standard contractual clauses and appropriate technical and organisational measures).
Among other things, we use tools from companies based in the USA or other third countries that do not have a level of data protection comparable to that of the EU. When these tools are active, your personal data may be transferred to these third countries and processed there.
We point out that the USA, as a safe third country, generally has a level of data protection comparable to that of the EU. A transfer of data to the USA is therefore permissible if the recipient is certified under the “EU-US Data Privacy Framework” (DPF) or has appropriate additional safeguards.
We point out that a level of data protection comparable to that of the EU cannot be guaranteed in third countries. For example, companies are obliged to hand over personal data to security authorities without you, as the data subject, being able to take legal action against this. It cannot be ruled out that authorities, such as intelligence services, process, analyse and permanently store your data located on servers hosted in third countries for surveillance purposes. We have no influence on this processing activity.
7. Security measures
We take appropriate technical and organisational measures so that we can ensure a level of protection appropriate to the risk within the meaning of Art. 32 GDPR.
8. Storage and Deletion of Data
Your personal data is stored within the framework of the purposes stated under the heading “Purpose of Collecting Personal Data”. The personal data of the data subject is deleted or blocked as soon as the purpose of the storage ceases to apply. Storage may also take place beyond this if provided for by the European or national legislator in Union regulations, laws or other provisions to which the controller is subject.
The data is also blocked or deleted when a storage period prescribed by the aforementioned provisions expires, unless there is a need for continued storage of the data pursuant to Art. 17(3) GDPR. If the data is not deleted because it is required for other and legally permissible purposes, its processing is restricted, i.e. the data is blocked and not processed for other purposes. This includes data that must be retained for tax law reasons.
9. Use of Cookies and Similar Technologies
Our websites use so-called “cookies”. Cookies are small text files and do not cause any damage to your device. They are stored on your device either temporarily for the duration of a session (session cookies) or permanently (persistent cookies). Session cookies are deleted automatically at the end of your visit. Persistent cookies remain stored on your device until you delete them yourself or your web browser deletes them automatically. In some cases, cookies from third-party companies may also be stored on your device when you use our online offers (third-party cookies). These enable us or you to use certain services of the third-party company (e.g. cookies for processing payment services).
Cookies have various functions. Numerous cookies are technically necessary, as certain website functions would not work without them (e.g. the shopping cart function or the display of videos). Other cookies serve to analyse user behaviour or to display advertising.
Cookies that are necessary to carry out the electronic communication process, to provide certain functions you have requested (e.g. for the shopping cart function) or to optimise the website (e.g. cookies for measuring the web audience) (necessary cookies) are stored on the basis of Art. 6(1)(f) GDPR, unless another legal basis is stated. The website operator has a legitimate interest in storing necessary cookies for the technically error-free and optimised provision of its services. Where consent to the storage of cookies and comparable recognition technologies has been requested, the processing takes place exclusively on the basis of this consent (Art. 6(1)(a) GDPR and Section 25(1) TDDDG); consent can be withdrawn at any time.
You can set your browser so that you are informed about the setting of cookies and only allow cookies on a case-by-case basis, exclude the acceptance of cookies for certain cases or in general, and activate the automatic deletion of cookies when the browser is closed. If cookies are deactivated, the functionality of this website may be limited.
Where cookies from third-party companies or cookies for analysis purposes are used, we will inform you separately about this within this privacy policy and, where applicable, request your consent.
In principle, our offers can be used without cookies or similar technologies that do not serve technical purposes. By accepting further functional cookies, we can improve the ease of use and the personalisation of our offer. We therefore recommend permanently enabling cookies for our website.
10. Newsletter
On our website you have the option of subscribing to our newsletter. We process the personal data submitted via the registration form to send you the individual newsletters. The user’s e-mail address is collected to deliver the newsletter. To reach measurement and the evaluation of our e-mail marketing campaigns, we collect data on your use of our newsletters, e.g. whether, how often and for how long you read them and which links in them you may click on. The collection of other personal data during the registration process serves to prevent misuse of the services or of the e-mail address used.
The legal basis for processing your personal data is Art. 6(1) sentence 1 lit. (a) GDPR, where applicable in conjunction with Section 7(2) no. 3 UWG. We may also send you certain information by e-mail based on a statutory permission under Section 7(3) UWG. You can withdraw the consent you have given at any time with effect for the future (e.g. via the “unsubscribe” link in the newsletter). If you exercise your right of withdrawal, we will delete the data concerned without delay, unless further processing can be based on a legal basis for processing without consent. The withdrawal of consent does not affect the lawfulness of the processing carried out based on the consent until the withdrawal.
The data you have provided to us for the purpose of receiving the newsletter will be stored by us or by the newsletter service provider until you unsubscribe from the newsletter and will be deleted from the newsletter distribution list after you unsubscribe or once the purpose ceases to apply. We reserve the right to delete or block e-mail addresses from our newsletter distribution list at our own discretion within the scope of our legitimate interest pursuant to Art. 6(1)(f) GDPR. You may object to the storage insofar as your interests override our legitimate interest.
Newsletter dispatch via CleverReach
Our e-mail newsletters are sent via the technical service provider CleverReach GmbH & Co. KG, Schafjückenweg 2, 26180 Rastede (“CleverReach”), to which we pass on the data you provided when subscribing to the newsletter. This disclosure takes place pursuant to Art. 6(1)(f) GDPR and serves our legitimate interest in using an effective, secure and user-friendly newsletter system. The data you enter for the purpose of receiving the newsletter (e.g. e-mail address) is stored on CleverReach’s servers.
CleverReach uses this information on our behalf to send and statistically evaluate the newsletters. For the evaluation, the e-mails sent contain so-called web beacons or tracking pixels, which are single-pixel image files stored on our website. This makes it possible to determine whether a newsletter message has been opened and which links, if any, have been clicked. With the help of so-called conversion tracking, it can also be analysed whether a predefined action (e.g. a purchase of a product on our website) has taken place after clicking on the link in the newsletter. Technical information is also collected (e.g. time of access, IP address, browser type and operating system). The data is collected exclusively in pseudonymised form and is not linked to your other personal data; direct identifiability is excluded. This data is used exclusively for the statistical analysis of newsletter campaigns. The results of these analyses can be used to better tailor future newsletters to the interests of the recipients.
If you wish to object to the data analysis for statistical evaluation purposes, you must unsubscribe from the newsletter.
We have concluded a data processing agreement with CleverReach in which we oblige CleverReach to protect our customers’ data and not to pass it on to third parties.
You can find further information on data protection at CleverReach in CleverReach’s privacy policy:
https://www.cleverreach.com/de-de/datenschutz/
11. Automated Individual Decision-Making
A fully automated decision means that decisions are made by technical means without the direct involvement of a person.
Automated decision-making pursuant to Art. 22 GDPR does not take place on our website. Should we use this procedure in individual cases, we will inform you separately about this – where required by law.
12. Use of Data for Profiling
Profiling means any form of automated processing of personal data consisting of the use of that personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
We do not process your data with the aim of evaluating certain personal aspects (profiling).
13. Use of Google Analytics 4
This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Google Analytics 4 uses so-called “cookies”, text files that are stored on your computer and that enable an analysis of your use of the website. The information generated by the cookie about your use of this website (including your IP address) is transmitted to a Google server in the EU. Google will use this information to evaluate your use of the website, to compile reports on website activity for the website operators and to provide further services connected with website use and internet use. This is done using a pseudonymous user identification number in order to assign analysis information to a device and to recognise which content users have accessed within one or several usage sessions, which content you have accessed or, for example, how you have used our online offer.
During your visit to the website, the following data, among others, is transmitted to Google:
This data is stored by Google together with a randomly generated user ID of its own.
Google processes the website usage data on our behalf and contractually undertakes to take measures to ensure the security and confidentiality of the processed data.
No personal data such as name, address or contact details is transmitted to Google Analytics.
This data may also be transmitted to Google servers in the USA. Please note that the same level of data protection as within the EU cannot be guaranteed in the USA.
Google Analytics stores cookies in your web browser for a period of two years since your last visit. These cookies contain a randomly generated user ID with which you can be recognised on future website visits.
The recorded data is stored together with the randomly generated user ID, which enables the evaluation of pseudonymous user profiles. This user-related data is automatically deleted after 14 months. Other data is stored indefinitely in aggregated form.
Google may also transfer this information to third parties where this is required by law or where third parties process this data on Google’s behalf. Google states that it will not associate your IP address with other data held by Google. By using this website, you declare your agreement to the processing of the data collected about you by Google in the manner described above and for the purpose stated above. To ensure the protection of user data in the EU, Google receives and processes all user data via domains and servers within the EU.
The Google tracking codes on this website use the “_anonymizeIp()” function, so that IP addresses are only processed further in shortened form to rule out direct identifiability. For EU users, the IP address is shortened on EU servers. You can object to the data collection and storage at any time with effect for the future. You can also prevent the collection of the data generated by the cookie and related to your use of the website (including your IP address) by Google, as well as the processing of this data by Google, by downloading and installing the browser plug-in available at the following link. The current link is http://tools.google.com/dlpage/gaoptout?hl=de .
Alternatively, you can prevent the collection by Google Analytics 4 on this website by clicking on the following link. An opt-out cookie is set via our cookie consent tool, which prevents the future collection of your data when you visit this website. The link is: Cookie settings ; however, we point out that in this case you may not be able to use all functions of this website to their full extent.
14. Use of Google Web Fonts
When YouTube videos (see section 17) are displayed on our website or by YouTube, Google Fonts and the Google Fonts API are used to display fonts and symbols visually. When using Google Fonts, unless the data is stored on the local servers of our online presence, Google also collects, processes and uses data about the use of the Fonts functions by visitors to the websites.
You can find more information about data processing by Google in Google’s privacy notices at http://www.google.com/privacypolicy.html. There, in the privacy centre, you can also change your settings so that you can manage and protect your data.
Google Web Fonts is used based on Art. 6(1)(f) GDPR. The website operator has a legitimate interest in the uniform presentation of the typeface on its website. Where corresponding consent has been requested, the processing takes place exclusively based on Art. 6(1)(a) GDPR and Section 25(1) TDDDG, insofar as the consent includes the storage of cookies or access to information on the user’s end device within the meaning of the TDDDG. Consent can be withdrawn at any time.
If your browser does not support web fonts, a default font from your computer is used.
The data transfer to the USA is based on the EU Commission’s standard contractual clauses. You can find details here:
https://privacy.google.com/businesses/gdprcontrollerterms/ and
https://privacy.google.com/businesses/gdprcontrollerterms/sccs/ .
You can find more information on the handling of user data in Google’s privacy policy:
https://policies.google.com/privacy?hl=de
The terms of use of Google Fonts can be found at https://fonts.google.com/about# and https://policies.google.com/terms?hl=en
15. Use of Google Maps
Our online presence uses Google Maps and the Google Maps API to display a site plan and geographical information visually. When using Google Maps, Google also collects, processes and uses data about the use of the Maps functions by visitors to the websites. Google Maps is used in the interest of an appealing presentation of our online offers and of making the locations stated on our website easy to find. This constitutes a legitimate interest within the meaning of Art. 6(1)(f) GDPR.
Where corresponding consent has been requested, the processing takes place exclusively on the basis of Art. 6(1)(a) GDPR and Section 25(1) TDDDG, insofar as the consent includes the storage of cookies or access to information on the user’s end device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent can be withdrawn at any time.
The data transfer to the USA is based on the EU Commission’s standard contractual clauses. You can find details here:
https://privacy.google.com/businesses/gdprcontrollerterms/ und
https://privacy.google.com/businesses/gdprcontrollerterms/sccs/ .
You can find more information on the handling of user data in Google’s privacy policy:
https://policies.google.com/privacy?hl=de
There you can also change your settings in the privacy centre so that you can manage and protect your data. The terms of use of Google Maps can be found at https://www.google.com/intl/de_de/help/terms_maps.html
16. Use of Google Tag Managers
Our online presence uses Google Tag Manager, a tool for managing website tags provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Tag Manager itself does not store any personal data. The Tag Manager organises access by other tags, which in turn may collect data. However, Google Tag Manager does not access this data.
If a deactivation has been carried out at domain or cookie level, it remains in place for all tracking tags implemented with Google Tag Manager. The use of Google Tag Manager constitutes a legitimate interest within the meaning of Art. 6(1)(f) GDPR.
Transfers to third countries are possible. Standard contractual clauses pursuant to Art. 46 GDPR have been concluded as appropriate safeguards. For third countries/companies for which an adequacy decision exists, the adequacy decision also applies.
In our default settings, the consent status for
is set to “granted”.
You can find more information on the handling of user data in Google’s privacy policy:
https://policies.google.com/privacy?hl=de
17. Use of YouTube
This website uses a link to YouTube of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When embedding, we use the “enhanced privacy mode”, so that usage information is only transmitted once the video is started. Cidemos (our CMS; see section 17) automatically displays the videos in the no-cookie version. In this case, it is transmitted which specific page of our website you have visited, and which video is being watched. If you are logged in to your YouTube account at the time, you enable YouTube to assign your page views directly to your personal profile.
If you want to make sure that no data about you is stored by YouTube, do not click on the embedded videos. YouTube is used in the interest of an appealing presentation of our online offers. This constitutes a legitimate interest within the meaning of Art. 6(1)(f) GDPR. Where corresponding consent has been requested, the processing takes place exclusively based on Art. 6(1)(a) GDPR and Section 25(1) TDDDG, insofar as the consent includes the storage of cookies or access to information on the user’s end device within the meaning of the TDDDG. Consent can be withdrawn at any time.
The data transfer to the USA is based on the EU Commission’s standard contractual clauses. You can find details here:
https://privacy.google.com/businesses/gdprcontrollerterms/ und
https://privacy.google.com/businesses/gdprcontrollerterms/sccs/
You can find further information on the handling of user data in Google’s privacy policy at:
https://policies.google.com/privacy?hl=de
18. CMS Cidemos
Our online presence uses the CMS (content management system) Cidemos to manage, publish and display our content and web pages. This enables the provision, updating and maintenance of the website. The system provider is Cicero Design GmbH, Brauereiweg 1, 06886 Lutherstadt Wittenberg. Cidemos uses so-called “cookies”, text files that are stored on your computer and that enable an analysis of your use of the website.
The information generated by the cookie about your use of this online offer is stored on a server in the USA. The IP address is anonymised before it is stored.
You can find the privacy policy of Cidemos at https://www.cicerodesign.de/datenschutz.html
19. Maxxton (Booking, Management and Customer Management System)
We use Maxxton as our central booking, management and customer management system to manage enquiries, bookings and accommodation and additional services. The system provider is Maxxton B.V., Oostperkweg 45, 4332 SB Middelburg, the Netherlands.
In this context, personal data may be processed in particular of you as the person making the booking, of accompanying travellers, of prospective customers and of business partners, in particular:
The processing takes place in particular for the following purposes:
The processing takes place, where necessary, on the basis of Art. 6(1)(b) GDPR, for the implementation of pre-contractual measures and the performance of contracts, on the basis of Art. 6(1)(c) GDPR for compliance with legal obligations, and on the basis of Art. 6(1)(f) GDPR for our internal organisation, customer care and administration.
Where Maxxton processes personal data on our behalf, it does so as a processor pursuant to Art. 28 GDPR based on a data processing agreement.
20. Microsoft Azure / Microsoft 365
We use Microsoft Azure and Microsoft 365 to provide our IT infrastructure and digital work environment, as well as for communication, collaboration, document management, and the storage, processing and backup of company data. The system provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland.
In the course of use, personal data of customers, agency partners and employees may be processed, in particular:
The processing takes place in particular for the following purposes:
Where Microsoft 365 services such as Outlook, Exchange, Teams, SharePoint or OneDrive are used, the personal data required for this may be processed to enable communication, collaboration and document management within our company.
The data stored in Microsoft Azure may also be processed for internal analysis and evaluation purposes. For this purpose, we use technical analysis tools within our Azure environment.
The processing takes place on the basis of Art. 6(1)(b) GDPR, insofar as it is necessary for the implementation of pre-contractual measures or the performance of a contract, on the basis of Art. 6(1)(c) GDPR, insofar as the processing is necessary for compliance with legal obligations, and on the basis of Art. 6(1)(f) GDPR on account of our legitimate interest in a secure and efficient IT infrastructure, internal organisation, communication and business administration.
Where employee data is processed, this takes place additionally based on the data protection provisions applicable to this.
Where Microsoft processes personal data on our behalf, it does so as a processor pursuant to Art. 28 GDPR based on a data processing agreement.
21. Databricks (Datenverarbeitungs- und Analyseplattform)
We use Databricks within our Microsoft Azure environment for the technical transfer, consolidation, processing and analysis of data from our booking system Maxxton and other internal systems.
Depending on the data sets integrated in each case, personal data may also be processed in the process.
The provider of the platform is Databricks, Inc., 160 Spear Street, Suite 1300, San Francisco, CA 94105, USA. Databricks, Inc. is a company based in the USA. Where personal data is transferred to the USA or processed there in the course of use, this takes place based on the European Commission’s adequacy decision on the EU-U.S. Data Privacy Framework. Databricks has certified to the US Department of Commerce its compliance with the principles of the EU-U.S. Data Privacy Framework with regard to such data.
https://www.databricks.com/de/legal/dpf
In the course of use, the following categories of personal data in particular may be processed, where necessary:
The processing takes place in particular for technical data integration, for reports and analyses, to support our business processes, for quality assurance, planning and to optimise internal workflows. The specific scope of the processing depends on the systems connected in each case. Databricks is not used for independent advertising purposes or profiling. The solution is operated in our Microsoft Azure environment. Separate storage of personal data by Databricks outside this environment does not take place within the deployment configured by us.
The processing takes place on the basis of Art. 6(1)(b) GDPR, insofar as it is necessary for the implementation of pre-contractual measures or the performance of a contract, on the basis of Art. 6(1)(c) GDPR, insofar as the processing is necessary for compliance with legal obligations, and on the basis of Art. 6(1)(f) GDPR on account of our legitimate interest in a secure and efficient IT-supported organisation, reporting and business administration.
Where Databricks processes personal data on our behalf and based on documented instructions, it does so as a processor pursuant to Art. 28 GDPR on the based on processing agreement.
22. Brevo (Marketing and Communication Platform)
We use Brevo to manage customer and business partner data and for marketing, communication and analysis purposes. The system provider is Brevo GmbH, Köpenicker Str. 126, 10179 Berlin.
In the course of use, personal data of customers, prospective customers and agency partners may be processed, in particular:
The processing takes place in particular for the following purposes:
Where marketing measures are based on consent, in particular when sending the newsletter, the processing takes place based on Art. 6(1)(a) GDPR. Where the requirements of Section 7(3) UWG are met, the processing for sending advertising to existing customers may take place on this basis.
Otherwise, the processing takes place based on Art. 6(1)(f) GDPR on account of our legitimate interest in customer communication, the maintenance of business relationships and the optimisation of our internal communication and sales activities.
Where Brevo processes personal data on our behalf and based on documented instructions, it does so as a processor pursuant to Art. 28 GDPR on the based on processing agreement.
23. Tally (Online-Form System)
We use Tally to provide digital forms for booking enquiries, pre-reservations and other enquiries on our website. The system provider is Tally B.V., Sint-Pietersnieuwstraat 11, 9000 Ghent, Belgium.
In the course of use, the following categories of personal data in particular may be processed:
The processing takes place in particular for the following purposes:
The processing takes place on the basis of Art. 6(1)(b) GDPR, insofar as it is necessary for the implementation of pre-contractual measures at your request or for the performance of a contract, on the basis of Art. 6(1)(c) GDPR, insofar as it is necessary for compliance with legal obligations, and otherwise on the basis of Art. 6(1)(f) GDPR on account of our legitimate interest in the efficient handling of enquiries and customer concerns.
Where Tally processes personal data on our behalf and based on documented instructions, it does so as a processor pursuant to Art. 28 GDPR on the based on processing agreement.
24. Confluence (Atlassian)
We use Confluence by Atlassian as an internal knowledge management and documentation system. It serves to make work instructions, internal guidelines, process descriptions and other relevant information available centrally to our employees and to support collaboration and a uniform way of working within the company. The system provider is Atlassian B.V., Singel 236, 1016 AB, Amsterdam, the Netherlands.
In the course of use, personal data of employees may be processed, in particular:
In addition, internal documentation and training materials on processes and workflows may, where necessary, contain sample data records from our operational systems (e.g. Maxxton). These examples serve exclusively for internal training, process documentation and quality assurance. In particular, booking data and other information necessary to illustrate a business transaction may be processed in this context.
The processing takes place in particular for the following purposes:
The processing takes place based on Art. 6(1)(f) GDPR on account of our legitimate interest in efficient internal organisation, secure knowledge management and the standardisation of our business processes. Where the processing is connected with the employment relationship, it takes place additionally based on the relevant data protection provisions for employee data.
Where Atlassian processes personal data on our behalf and based on documented instructions, it does so as a processor pursuant to Art. 28 GDPR on the based on processing agreement.
25. Veeam Data Cloud (Backup and Data Protection System)
We use Veeam to back up and restore our IT systems and company data. The solution serves to create, manage and store data backups to ensure the availability, integrity and recoverability of our data in the event of technical faults, accidental deletions, system failures or other security incidents. The system provider is Veeam Software Group GmbH, Lindenstraße 8, 6340 Baar, Switzerland.
In the course of data backup, personal data may be processed only to the extent that it is contained in the systems we back up. This may include, in particular, data of customers, agency partners and employees, for example:
The processing takes place exclusively for the following purposes:
The processing takes place on the basis of Art. 6(1)(c) GDPR, insofar as the backup is necessary to comply with statutory retention or documentation obligations, and on the basis of Art. 6(1)(f) GDPR on account of our legitimate interest in a secure and failure-resistant IT infrastructure and in safeguarding the availability, integrity and confidentiality of our data.
Where Veeam processes personal data on our behalf and based on documented instructions, it does so as a processor pursuant to Art. 28 GDPR on the based on processing agreement.
26. Security, Questions and Suggestions
Security also depends, not least, on your system. You should always treat your access information as confidential, never allow passwords to be saved by your web browser and close the browser window when you finish your visit to our website. This makes it harder for third parties to gain access to your personal data.
Use an operating system that can manage user rights. Also set up separate user accounts on your system for the other members of your family and never use the internet with administrator rights. Use security software such as virus scanners and firewalls and keep your system continuously up to date.
27. Right of Access / Right to Withdraw Consent; Further Data Subject Rights
We point out that you
If the data processing is based on Art. 6(1)(e) or (f) GDPR, you have the right, on grounds relating to your particular situation, to object at any time to the processing of your personal data; this also applies to profiling based on these provisions. You can find the respective legal basis on which processing is based in this privacy policy. If you object, we will no longer process your personal data concerned, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims (objection pursuant to Art. 21(1) GDPR).
If your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing; this also applies to profiling to the extent that it is related to such direct marketing. If you object, your personal data will subsequently no longer be used for direct marketing purposes (objection pursuant to Art. 21(2) GDPR).
These rights are, of course, available to you free of charge. To withdraw your consent to data use, to request information or the rectification, blocking or erasure of data, or to exercise the other data subject rights, please contact:
Albatross Reisen GmbH, Marktbreiter Str. 11, 97199 Ochsenfurt
E-Mail: datenschutz@albatross.de
We point out that you can most easily assert your data subject rights in connection with your use of social media against the social media companies, and that you can also make further settings there to protect your privacy with the social media companies.
Below we also provide the contact address of our company’s data protection officer. Our company data protection officer is:
Yvonne Herrmann, Albatross Reisen GmbH, e-mail: datenschutz@albatross.de ; telephone: +49 9331 983040.
To exercise your data subject rights such as access, rectification, blocking or erasure of your personal data, please do not contact the data protection officer directly, but first the above-mentioned department of the controller directly, which will deal with your request without delay.
28. Competent Supervisory Authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR.
The supervisory authority with which the complaint was lodged will inform the complainant of the progress and outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.
You can reach the supervisory authority competent for you for complaints within the meaning of Art. 77 GDPR at the following contact details:
Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht – BayLDA)
Promenade 27
91522 Ansbach
poststelle@lda.bayern.de
29. Unsubscribe from the Newsletter
If you no longer wish to receive our newsletter or our promotional e-mails, click on the “Unsubscribe from newsletter” link, which is included at the end of all e-mails we send.
Albatross Reisen GmbH, Marktbreiter Str. 11, D-97199 Ochsenfurt
Tel.: +49 9331 98304-0, Fax: +49 9331 98304-29, e-mail: info@albatross.de
