Privacy policy for prize competition

Privacy policy for prize competition

We give great importance to the protection of your personal data and compliance with data protection laws. Below, we inform you in particular about which personal data is processed for which purposes and on which legal basis.

1. Who is responsible for data processing?

HolidayPirates GmbH, Neue Grünstrasse 18, 10179 Berlin, Germany is the data controller. The Data Protection Commissioner of the HolidayPirates GmbH can be contacted here: [email protected]

2. Which categories of personal data are being used?

We process the contact data (email address of all participants), in addition to the protocol data which arise with the use of our IT systems. Furthermore, we process the following types of contact data provided by the winners of the competition:

• First Name

• Instagram username

• Email-Address

• Address and IBAN + BIC of winner's bank account

To accept the prize the winner have to give consent to publish the winner’s name (first name and first letter of last name or their Instagram username) on our Instagram (@holidaypirates, @urlaubspiraten, @vakantiepiraten, @voyagespirates, @piratinviaggio, @travelpirates and @viajerospiratas).

3. Where do these data come from?

The data comes directly from you as they have been collected in the course of participating in the prize draw.

4. For which purposes are my data being processed? Which is the legal basis that the company bases this on?

a. Art 6 para 1 b) GDPR

We process personal data within the framework of contractual negotiations and the performance of the contract for the prize draw that has been concluded between you and us.

Processing takes place for the provision of contractually guaranteed services like e.g. the fulfilment of a possible claim for the prize offered as part of the competition.

Legal basis is Art. 6 para. 1 b) GDPR. Within the scope of contract fulfilment and performance we process the data that you provide to us upon formation of the contract or in the course of the contractual relationship. This includes in particular your master information (name, surname, date of birth, address, e-mail address).

b. Art. 6 para 1 a) GDPR

If you have provided us with your consent to process data, we do so for the purposes informed about in the course of the declaration of consent. Consent that you have provided may be revoked at any time.

c. Art. 6 para 1 f) GDPR

We process your data in order to protect our own legitimate interest or those of third parties. This applies in particular to internal communication between affiliated companies and other administrative purposes.

5. Will data be transferred?

Within our company respectively the group of companies those employees receive access to your data who need the data in order to fulfil the contractual or legal responsibilities. For the purpose of prize fulfilment, the personal data of the winner (such as name, email address, and/or delivery details) may be shared with third-party sponsors responsible for providing the prize. This data will be transferred solely for the purpose of arranging and delivering the prize and will not be used for any other purposes. By participating in the contest, entrants agree to this transfer of data.

Moreover, service providers that we use may also receive data for these purposes:

HolidayPirates GmbH

Neue Grünstrasse 18

D - 10179 Berlin

TUI UK

Wigmore House, Wigmore Pl, Wigmore Ln, Luton LU2 9TN

Vonage Business Limited

15 Bonhill Street, London, EC2A 4DN , United Kingdom

KVK number: 34223740

VAT ID: NL814599941B02

Rosetta Stone GmbH

Christophstr. 31

50670 Köln

Deutschland

Instagram/Meta

We present online offers on social media platforms to provide information and to facilitate contact with you.

• Address: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland

• GDPR Compliance: https://help.instagram.com/519522125107875/?helpref=uf_share

• Purpose: The data are used to improve Facebook products and services and to deliver relevant advertising.

• Disclosed data: Facebook user ID, page URL, date and time and other browser information

Whatsapp Inc.

• Address: WhatsApp, Inc., 1601 Willow Road, Menlo Park, California 94025, USA

• GDPR: https://www.whatsapp.com/legal/privacy-policy-eea

• Purpose: For direct communication and sending offers from our website

• Data processed: All pseudonymised data. Telephone number, profile picture (optional), first and last name (optional), messenger ID (automatic), messages sent to us.

The user accepts WhatsApp's terms and conditions when downloading the application. HolidayPirates GmbH does not transfer or send any personal data from WhatsApp.

Braze Inc.

• Address & place of jurisdiction: Braze Inc., 318 West 39th Street, New York, NY 10018

• GDPR Compliance: https://www.braze.com/docs/help/gdpr_compliance/

• Purpose: Fulfil campaign obligations created by HolidayPirates GmbH, advertising the contest, show sign up screen in app, collect email address & save information to draw winner, send push notifications for the contest and after the termination of the contest

• Disclosed Data: analysing user behaviour in the app to receive personalised contest notifications, email address, basic non-identifiable information from the device (country, language, time zone, operating system, App version and device ID).

In order to find out more about data and tracking in the app please see our data protection policy.

Adjust GmbH (Apps)

• Address: adjust GmbH, Saarbrücker Str. 37A, 10405 Berlin, Germany

• GDPR Compliance: https://www.adjust.com/gdpr/

• Purpose: Analyze the contest performance and identify mobile application behaviour to take targeted marketing decisions and efficiently execute and optimise mobile campaigns for social networks and other websites

• All pseudonymised data: Pseudonymous cookie ID, ad ID and device ID used by a particular person, events in the mobile app related to the use of the mobile app by a specific user (in particular login and successful completion of the transaction), but no payment and financial data

Content of the advertisement to be delivered to a particular user and, as appropriate, classified advertising group to which that person belongs.

Playable ApS

• Address & place of jurisdiction: Playable ApS, Tueager 1, Aarhus N, Jylland 8200 Denmark

• GDPR Compliance: https://playable.com/privacy-policy-for-playable-aps/

• Purpose: Playable is used to facilitate gamified marketing campaigns aimed at expanding our newsletter subscriber base.

• Disclosed Data: The tool collects and processes personal data only as necessary to track participation, manage participant rewards, and measure campaign effectiveness, such as first name, email and game statistics.

Playable ApS is used as our order processor pursuant to Art. 28 GDPR. For details please see our Data Protection Policy.

Iterable Inc.

The technical service provider Iterable Inc. is our processor for sending newsletters.

• Address & place of jurisdiction: Iterable Inc., 71 Stevenson Street, 3rd Floor, San Francisco, CA 94105, USA.

• GDPR Compliance: https://iterable.com/trust/privacy-policy/

• Purpose: For advertising campaigns and sending offers from our website.

• Disclosed Data: Email address (required), First and last name (voluntary), Subscription date (automatically collected), The country selected for the subscription (automatically collected).

In return for participating in the competition, we ask for your consent for us to send you our Newsletter with our best holiday deals and travel information by email in the future. Your personal data will only be used for this purpose. You can revoke your consent at any time. More in our privacy policy.

When you subscribe to the newsletter, your behaviour in our newsletter is recorded (tracking the opening of emails and clicks on links). As soon as you open, and/or click on a newsletter, pseudonymised data will be saved. In this case, we are using the data for the optimization of our website contents and offers. In order to be able to adapt our newsletter to your needs, we use cookies which track your links if necessary (retargeting). In this way, you will receive special offers and information that fit your actual interest. By subscribing to our newsletter, you agree to this procedure. Of course, you always have the opportunity to contradict this.

The legal basis for sending the newsletter is your consent in accordance with Art. 6 para. 1 (a) GDPR.

By registering, you also consent to your data being processed in the USA in accordance with Article 49 Paragraph 1 Sentence 1 Letter a GDPR. The USA is assessed by the European Court of Justice as a country with an inadequate level of data protection according to EU standards. In particular, there is a risk that your data may be processed by US authorities for control and monitoring purposes, possibly even without any legal remedy.

You can unsubscribe from our newsletter at any time; the link to do so is at the end of every newsletter. As soon as you have unsubscribed from the newsletter, you will no longer receive any offers from us. Your personal data will not be reused and are blocked immediately. Your data will be saved for another 3 years before it will be deleted. Legal basis for saving the data is our entitled interest of proving that the delivery of emails happened with your consent in order to ward off potential claims.

6. What are my rights?

Basically you have the following rights:

right of access (Art. 15 GDPR)

right to rectification (Art. 16 GDPR)

right to object (Art. 21 GDPR)

right to erasure (Art. 17 GDPR)

right to restriction of processing (Art. 18 GDPR)

right to data portability (Art. 20 GDPR)

Where we cite our legitimate interest (Art. 6 para 1 f) GDPR) as the legal basis, you have a right to objection pursuant to Art. 21 GDPR.

According to Art. 21 GDPR you have the right

to object to the processing of personal data at any time. We will then no longer process the personal data for direct marketing purposes or a related profiling.

We also do not process your personal data for other purposes after your objection unless we can demonstrate reasons that are binding and worthy of protection for the processing of the data which outweigh your interests, rights and freedoms, or the processing of your personal data serves to assert, exercise or defend legal claims (cf. Art. 21 para. 1, para. 6 GDPR, so-called "limited right of objection"). In this case, you must explain the reasons for the objection arising from your particular situation.

7. Do I have a right to complain?

Yes, you have the possibility to address your complaint directly to us or towards the competent data protection authority.

We attach great importance to transparency. Please do not hesitate to contact us if you have any questions.

8. How long will my data be saved?

We process and store your personal data for the period of the existing contract. We will regularly delete the data when data is not required for contractual or legal purposed anymore. However, we need to take into account legal retention periods (in particular § 257 HGB and § 147 AO). These are up to 10 years.

Insofar as data is to be retained to ensure enforcement of legal claims, the limitation periods can be up to 30 years, whereby the regular limitation period is three years.

If your data is used for advertising purposes, we will only process the data until you object to its use or have revoked your consent or until usage is no longer permitted by law.

9. Do I have to give you my data?

In the context of our contractual relationship, you must provide the personal data that is necessary for the performance and fulfilment of the contract or the processing of which we are legally bound. Failure to make them available would mean that we would regularly are unable to conclude the contract with you.