A-ROSA Resort GmbH privacy policy

Overview of contents:

1. Overview
1.1 Scope
1.2 Controller
1.3 Data Protection Officer
2. Data processing in detail
2.1 General information about data processing
2.2 Accessing the website
2.3 Newsletter
2.4 Reservation
2.5 Reception/stay at the resort
2.6 Call recording in the service center
3. Rights of data subjects
3.1 Right to object
3.2 Right to access
3.3 Right to rectification
3.4 Right to erasure (‘right to be forgotten’)
3.5 Right to restriction of processing
3.6 Right to data portability
3.7 Right to withdraw consent
3.8 Right to lodge a complaint

Overview

This section of the Privacy Policy contains information on its scope, the data controller and the controller’s data protection officer.

Scope

On this page, we inform you about the type, scope and purpose of the personal data collected by a-ja Resort und Hotel GmbH, which is processed both when you visit this website and in other processing operations that are not related to this website and are our responsibility.

Controller

The data controller – i.e. the person who decides on the purposes and means of processing personal data – in connection with the processing is:

A-ROSA Resort GmbH

Lange Strasse 1a

18055 Rostock, Germany

Phone: +49 (0)40 300 322 100

Fax: +49 (0)40 300 322 109

E-mail: kontakt.resort@a-rosa.de

Data Protection Officer

You can contact our Data Protection Officer as follows:

Contact form:
https://www.dsextern.de/anfragen
DS EXTERN GmbH
Marc Althaus
Frapanweg 22  
22589 Hamburg, Germany

Data processing in detail

In this section of the Privacy Policy, we provide you with detailed information about the processing of personal data. For the sake of clarity, we categorise this information according to specific functionalities.

General information about data processing

Unless otherwise stated, the following applies to all processing operations:

No obligation to provide

There is no contractual or legal obligation to provide personal data. You are under no obligation to provide data.

Consequences of non-provision

In the case of necessary data (data marked as mandatory data at the time of entry), failure to provide such data will result in the relevant service being unable to be provided. Otherwise, non-provision may result in our services being unable to be provided in the same form and quality.

Consent

In various cases, you have the option of giving us your consent to further processing in connection with the processing described below (if applicable, for some of the data). In such cases, we will inform you separately, in conjunction with the submission of the respective declaration of consent, about all the technicalities and scope of consent and about the purposes we pursue with such processing.

Photographs and video recordings

Events by the A-ROSA Resorts brand may be documented by means of photographs and video recordings. Photographs, such as team photos or event photos, are used online on the respective event page. Selected image material from the event may be used for social media photographs in Web resolution as well as in various print media. Photographs and film recordings are not passed on to third parties in any other way.

A participant may object to the storage, use and distribution of the recordings that have been made of him or her at any time with effect for the future. If the objection is made before the start of an event of the A-JA Resorts brand, DSR Hotel Holding will delete all recordings made of the participant immediately after the end of the event. The objection may be made in writing (e.g. by letter) or in text form (e.g. by fax or email). If you object, please include your surname and first name as well as the date and name of the event.

Transmission to government agencies

We only transfer personal data to government agencies (including law enforcement agencies) when it is necessary to comply with a legal obligation to which we are subject (legal grounds: GDPR Article 6(1)(c)) or is necessary for the establishment, exercise or defence of legal claims (legal grounds: GDPR Article 6(1)(f)).

Duration of storage

We do not store your data for longer than we need it for the respective purposes of the processing. If the data is no longer required, it will be erased on a regular basis unless it remains necessary to retain it for a limited period of time. Reasons for this may include, for example, the following:

•    Compliance with retention obligations under commercial and tax laws

•    Preservation of evidence for legal disputes within the framework of statutory limitation periods

Categories of recipients

In addition to the categories of recipients explicitly listed below, personal data is also transmitted to the following categories of recipients: delivery contractors and telephone and fax companies.

Data categories

•    Basic personal data: title, form of address/gender, first name, surname, date of birth

•    Address details: street, house number, other address lines if applicable, postcode, town/city, country

•    Contact details: Telephone number(s), fax number(s), email address(es)

•    Login details: information about the service through which you have registered; times of and technical information about registration, confirmation and cancellation; data you provide when registering

•    Booking details: bookings, prices, payment information

•    Payment details: bank account data, credit card data, data about other payment services

•    Access data: date and time of your visit to our service; the page from which the accessing system came to our site; pages accessed during use; session ID data; and the following information about the accessing computer system: Internet Protocol (IP) address, browser type and version, device type, operating system and similar technical information

Accessing the website

This section describes how we process your personal data when you access the website.

Information on processing

•    Data category: access data

•    Purposes: establishing a connection, displaying the content of the service, detecting attacks on our site based on unusual activities, diagnosing errors

•    Legal grounds: protection of legitimate interests (GDPR Article 6(1)(f))

•    Legitimate interest, if applicable: proper functioning of the services, security of data and business processes, prevention of misuse, prevention of damage due to interference with information systems

•    Duration of storage: 7 days

•    Recipients: IT security service providers, hosting service providers, consent tool providers

•    Transmission to third countries: -

Tracking for the analysis and optimisation of our services and the use of them as well as the measurement of advertising campaign success and advertisement optimisation

Information about the services used can be found under ‘Manage cookies’ in the footer or in the consent tool.

Newsletter

We describe here what happens to your personal data in connection with a subscription to our newsletter:

Information on processing

•    Data category:

o    Email address

o    Newsletter usage profile data

o    Login details

•    Purposes:

o    Verifying registration (double opt-in), sending newsletter

o    Designing the newsletter in line with interests

o    Communicating newsletter registration/confirmation/cancellation

•    Legal grounds:

o    Consent (GDPR Article 6(1)(a))

o    Consent (GDPR Article 6(1)(a))

o    Protection of legitimate interests (GDPR Article 6(1)(f))

•    Legitimate interest, if applicable: Evidence of newsletter subscription/confirmation/cancellation

•    Duration of storage: Duration of the newsletter subscription (cancellation data without limitation in order to fulfil accountability obligations)

•    Recipients: newsletter delivery services

•    Transmission to third countries: -

Reservation

Find out here how we process your personal data when you contact our customer service:

Information on processing

•    Data category:

o    Basic personal data

o    Contact details

o    Content of enquiries/bookings/complaints

o    Payment details

•    Purposes: processing customer enquiries, bookings and complaints

•    Legal grounds: contract (GDPR Article 6(1)(b)), protection of legitimate interests (GDPR Article 6(1)(f))

•    Legitimate interest, if applicable: customer loyalty, sales, improvement of customer satisfaction

•    Duration of storage: processing of the enquiry, booking data in accordance with the statutory retention period (10 years)

•    Recipients: payment service providers

•    Transmission to third countries: -

Reception/stay at the resort

How we process your personal data when it is at our resort can be found here:

Information on processing

•    Data category:

o    Basic personal data

o    Address details

o    Contact details

o    Booking details

o    Payment details

•    Purposes: fulfilment of the accommodation agreement

•    Legal grounds: contract (GDPR Article 6(1)(b))

•    Legitimate interest, if applicable: -

•    Duration of storage: booking data in accordance with the statutory retention period (10 years)

•    Recipients: payment service provider, reservation system provider

•    Transmission to third countries: -

Call Recording in the Service Center

This section explains how your personal data is processed when calls are recorded.

Information on Data Processing

• Categories of Data: Contact details (telephone number only); call metadata (date and time of the call, call duration, and reason for the call based on IVR selection); conversation content; records documenting proof of consent
• Purpose of Processing: Quality assurance and service improvement
• Legal Basis: Consent (Article 6(1)(a) GDPR)
• Legitimate Interest: -
• Data Retention Period: Call recordings: 4 months; consent documentation logs: 3 years
• Recipients: Internal (Customer Service Center management team); External (telephony system provider)
• International Data Transfers: -

Rights of data subjects

Right to object

You have the right, on grounds relating to your particular situation, to object at any time with future effect to the processing of personal data concerning you pursuant to GDPR Article 6(1)(e) or (f).

You can exercise your right to object free of charge.

Right to access

You have the right to know whether we process personal data concerning you, to know which personal data this may be and to receive further information in accordance with GDPR Article 15.

Right to rectification

You have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you (GDPR Article 16). Taking into account the purposes of the processing, you have the right to request the completion of incomplete personal data, including by means of a supplementary statement.

Right to erasure (‘right to be forgotten’)

You have the right to obtain from us the erasure of personal data concerning you without undue delay, provided that one of the reasons set out in GDPR Article 17(1) applies and the processing is not necessary for one of the purposes set out in GDPR Article 17(3).

Right to restriction of processing

You are entitled to request a restriction of the processing of your personal data if one of the conditions set out in GDPR Article 18(1)(a) to (d) is met.

Right to data portability

You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format. Furthermore, you have the right to transmit this data to another controller without hindrance from us or to have it transmitted directly by us, insofar as this is technically possible. This should always apply if the grounds for data processing are consent or a contract and the data is processed automatically. This does not apply to data held only in paper form.

Right to withdraw consent

If the processing is based on your consent, you have the right to withdraw your consent at any time. This does not affect the lawfulness of the processing carried out on the grounds of consent prior to withdrawal.

Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority.