Privacy Policy for Prize Competition
We attach great importance to protecting your personal data and complying with applicable data protection laws. Below, we explain which personal data we process, for what purposes and on what legal basis.
1. Who is responsible for processing your data?
HolidayPirates GmbH, Neue Grünstrasse 18, 10179 Berlin, Germany, is the data controller. The Data Protection Officer of HolidayPirates GmbH can be contacted at: [email protected]
2. Which categories of personal data do we process?
We process contact data (such as your email address), as well as protocol data generated through the use of our IT systems. In addition, we process the following personal data provided by the winner of the competition:
3. Where does this data come from?
The data comes directly from you and is collected when you participate in the prize draw.
4. For what purposes do we process your data, and what is the legal basis?
a. Art. 6(1)(b) GDPR – Performance of a contract
We process personal data in connection with the performance of the contract for the prize draw concluded between you and us.
This processing is necessary to provide the services guaranteed under the contract, including fulfilling any entitlement to a prize offered as part of the competition.
The legal basis is Art. 6(1)(b) GDPR. As part of performing the contract, we process the data you provide when entering into the contract or during the contractual relationship. This includes, in particular, your personal details, such as your full name, date of birth, postal address and email address.
b. Art. 6(1)(a) GDPR – Consent
If you have given us your consent to process your personal data, we process your data for the purposes specified when you gave that consent. You may withdraw your consent at any time.
c. Art. 6(1)(f) GDPR – Legitimate interests
We process your data to protect our legitimate interests or those of third parties. This applies in particular to internal communication between affiliated companies and other administrative purposes.
5. Will your data be transferred?
Within our company and group of companies, employees who require access to your data in order to fulfil their contractual or legal responsibilities may have access to it. In addition, service providers we use may receive your data for these purposes.
Playable ApS
Address: Playable ApS, Tueager 1, Aarhus N, Jylland 8200, Denmark
GDPR compliance: [Playable Privacy Policy]
Purpose: Playable is used to facilitate gamified marketing campaigns aimed at increasing our newsletter subscriber base.
Data disclosed: The tool collects and processes personal data only to the extent necessary to track participation, manage participant rewards and measure campaign effectiveness. This may include first name, email address and game statistics.
Playable ApS is used as our data processor pursuant to Art. 28 GDPR. For further details, please see our Data Protection Policy: <>
Iterable Inc.
Iterable Inc. is our technical service provider and data processor for sending newsletters.
Address: Iterable Inc., 71 Stevenson Street, 3rd Floor, San Francisco, CA 94105, USA
GDPR compliance: [Iterable Privacy Policy]
Purpose: Advertising campaigns and sending offers from our website
Data disclosed: Email address (required), first and last name (voluntary), subscription date (automatically collected) and the country selected for the subscription (automatically collected).
By participating in the competition, we ask for your consent to send you our newsletter by email in the future, including our best holiday deals and travel information. Your personal data will only be used for this purpose. You may withdraw your consent at any time. Further information can be found in our privacy policy: https://www.holidaypirates.com/legal/data-protection-declaration
When you subscribe to the newsletter, we record your interactions with our newsletter, including whether you open emails and click on links. When you open or click on a newsletter, pseudonymised data is stored. We use this data to optimise the content and offers on our website.
To tailor our newsletter to your interests, we may use cookies that track your interactions with links for retargeting purposes. This allows us to provide you with special offers and information that are relevant to your interests. By subscribing to our newsletter, you consent to this processing. You may withdraw your consent at any time.
The legal basis for sending the newsletter is your consent in accordance with Art. 6(1)(a) GDPR.
By registering, you also consent to your data being processed in the USA in accordance with Article 49(1)(a) GDPR. The USA is considered by the European Court of Justice to provide an inadequate level of data protection under EU standards. In particular, there is a risk that your data may be processed by US authorities for monitoring and surveillance purposes, potentially without effective legal remedies.
You can unsubscribe from our newsletter at any time using the link at the bottom of every newsletter. Once you have unsubscribed, you will no longer receive offers from us. Your personal data will no longer be used for this purpose and will be blocked immediately. Your data will be retained for a further three years before being deleted. The legal basis for retaining this data is our legitimate interest in being able to demonstrate that emails were sent with your consent and in defending against potential legal claims.
Commerzbank Aktiengesellschaft
Address: Commerzbank Aktiengesellschaft, Kaiserplatz, 60311 Frankfurt/Main
GDPR compliance: [Commerzbank Privacy Policy]
Bank details will be stored temporarily for internal administrative purposes, for example where they are sent by email to our finance department. This data will be deleted internally once the transfer has been completed.
Bank statements must be retained for 10 years in accordance with applicable tax and commercial law requirements. This data will be permanently deleted once the applicable statutory retention periods have expired.
App usage
We collect information about your activity in our app, including service-related, diagnostic and performance information. This includes information about your activity, such as how you use our services, your service settings, how you interact with other users of our services, and the time, frequency and duration of your activities and interactions. It also includes log files and diagnostic, crash, website and performance logs and reports.
If you have not disabled tracking in the app under “Usage and Log Information”, certain pseudonymous data may be sent to Adjust GmbH, Facebook Inc. and Google Ireland Limited.
The processing of this data is based on Art. 6(1)(f) GDPR and our legitimate economic interest in optimising existing products and services and providing technical functionality.
For further details, please see our Data Protection Policy.
6. What are my rights?
You have the following rights under applicable data protection law:
Right of access (Art. 15 GDPR)
Right to rectification (Art. 16 GDPR)
Right to object (Art. 21 GDPR)
Right to erasure (Art. 17 GDPR)
Right to restriction of processing (Art. 18 GDPR)
Right to data portability (Art. 20 GDPR)
Where we rely on legitimate interests under Art. 6(1)(f) GDPR as the legal basis for processing, you have the right to object pursuant to Art. 21 GDPR.
Under Art. 21 GDPR, you have the right to object to the processing of your personal data at any time. We will then no longer process your personal data for direct marketing purposes or related profiling.
We will also stop processing your personal data for other purposes following an objection unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims (see Art. 21(1) and (6) GDPR, the so-called “limited right to object”). In this case, you must explain the reasons arising from your particular situation on which your objection is based.
7. Do I have the right to complain?
Yes. You have the right to lodge a complaint with us directly or with the competent data protection supervisory authority.
We attach great importance to transparency. Please do not hesitate to contact us if you have any questions.
8. How long will my data be stored?
We process and store your personal data for the duration of the existing contractual relationship. We will generally delete your data when it is no longer required for contractual or legal purposes.
However, statutory retention periods must be observed, in particular under Section 257 of the German Commercial Code (HGB) and Section 147 of the German Fiscal Code (AO). These retention periods can be up to 10 years.
Where data needs to be retained to ensure the enforcement of legal claims, the applicable limitation periods may be up to 30 years, although the standard limitation period is three years.
If your data is used for advertising purposes, we will process it only until you object to its use, withdraw your consent, or such processing is no longer permitted by law.
9. Do I have to provide my data?
As part of our contractual relationship, you must provide the personal data that is necessary for the performance and fulfilment of the contract or that we are legally required to process. If you do not provide this data, we may generally be unable to conclude or perform the contract with you.
