Privacy policy for a prize competition
We place great importance on the protection of your personal data and our compliance with data protection laws. Below, we explain which personal data is processed, for what purposes, and the legal basis for doing so.
1. Who is responsible for data processing?
HolidayPirates GmbH, Neue Grünstrasse 18, 10179 Berlin, Germany, is the Data Controller. You can contact our Data Protection Officer at: [email protected]
2. Categories of personal data processed
We process contact data (email address) and protocol data generated through the use of our IT systems. Additionally, we process the following information provided by the winner:
Full Name
Email Address
Postal Address
Bank details (IBAN/BIC) for prize-related transfers.
3. Source of the data
This data is collected directly from you when you enter the prize draw.
4. Purposes and legal basis for processing
a. Performance of a Contract (Art. 6 para 1 (b) UK/EU GDPR) We process personal data to manage your entry and perform our obligations under the prize draw terms and conditions. This includes fulfilling claims for prizes and managing your master data (name, address, email).
b. Consent (Art. 6 para 1 (a) UK/EU GDPR) If you have consented to receive our newsletter, we process your data for the purposes outlined in that declaration. You may withdraw your consent at any time.
c. Legitimate Interests (Art. 6 para 1 (f) UK/EU GDPR) We process data to protect our legitimate interests or those of third parties, specifically for internal administrative purposes and group-wide communication.
5. Data Transfers and Service Providers
Access to your data is restricted to employees who require it to fulfil contractual or legal duties. We also use the following service providers:
Iterable Inc. (USA): Our technical provider for sending newsletters. By subscribing, you acknowledge that your data may be processed in the USA. While the US is often viewed as having different data protection standards, we ensure appropriate safeguards are in place.
Commerzbank AG: Bank details are stored temporarily for prize transfers and are retained for 10 years to comply with statutory tax and commercial record-keeping requirements.
Newsletter & Tracking: When you subscribe to our newsletter, we track engagement (opens and clicks) to optimise our content. We use cookies for retargeting to provide offers that match your interests. You can unsubscribe at any time via the link at the bottom of every email. Upon unsubscribing, your data is blocked and subsequently deleted after 3 years (this retention period serves our legitimate interest in defending potential legal claims).
App Usage: We collect diagnostic and performance information. Unless disabled in your app settings ("Usage and Log Information"), pseudonymous data may be sent to Adjust GmbH, Meta (Facebook), and Google to help us optimise our services.
6. Your Rights
Under data protection law, you have the following rights:
Access: To request a copy of your data.
Rectification: To correct inaccurate data.
Objection: To object to processing based on legitimate interests or for direct marketing.
Erasure: To request your data be deleted ("Right to be forgotten").
Restriction: To limit how we use your data.
Portability: To receive your data in a machine-readable format.
If you object to processing for direct marketing, we will stop using your data for this purpose immediately.
7. Right to Complain
You have the right to lodge a complaint with us directly or with a competent supervisory authority. In the UK, this is the Information Commissioner’s Office (ICO).
8. Data Retention
We store your data for the duration of our contractual relationship. Statutory retention periods for commercial and tax purposes (up to 10 years) apply. For the enforcement of legal claims, data may be kept for up to 30 years, though the standard limitation period is 3 years. Advertising data is kept until you withdraw consent or object to its use.
9. Requirement to Provide Data
To enter the competition or receive the newsletter, you must provide the necessary data. Without this information, we are unable to enter you into the draw or fulfill the contract.
