Privacy statement
Last update: 13.12.2018
Here you find further detailed information about cookies.

Privacy Policy

I. Name and address of the contoller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws of the member states as well as other legal data protection provisions is:

Impax Tours UG IMPAX Tours (haftungsbeschränkt)., Rochusstraße 1, 52062 Aachen, Germany

Phone: +49 241 41 250 221

E-mail: info@impax-tours.com

Website: www.impax-tours.com

This website (hereinafter the "website", "Online Presence") is provided by the controller IMPAX Tours UG IMPAX Tours (haftungsbeschränkt). (hereinafter "us" or "we").

II. General information on data processing

1. Scope of processing of personal data

We process the personal data of our users insofar as this is necessary to provide a functioning website as well as our content and services. The processing of personal data of our users takes place regularly only with the consent of the user. An exception applies in those cases in which it is not possible to obtain prior consent for actual reasons and the processing of the data is permitted by legal provisions.

2. Legal basis for processing of personal data

Insofar as we obtain the consent of the data subject for processing personal data, Art. 6 (1 a) GDPR serves as the legal basis.

Art. 6 (1 b) GDPR serves as the legal basis for the processing of personal data necessary for the performance of a contract to which the data subject is a party. This also applies to processing operations that are necessary to implement pre-contractual measures.

Insofar as the processing of personal data is necessary for compliance with a legal obligation to which our enterprise is subject, Art. 6 (1 c) GDPR serves as the legal basis.

If vital interests of the data subject or another natural person necessitate the processing of personal data, Art. 6 (1 d) GDPR serves as the legal basis.

If processing is necessary for safeguarding the legitimate interests of our enterprise or of a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, Art. 6 (1 f) GDPR serves as the legal basis for processing this data.

3. Data transfer

Your personal data will only be transmitted to third parties in the mentioned cases:

- You have given your explicit consent [Art. 6 (1 a) GDPR]

- The transfer serves to perform contractual relationships with you and is legally permissible and necessary [Art. 6 (1 b) GDPR]

- The transfer serves to comply with a legal obligation [Art. 6 (1 c) GDPR]

- The transfer is necessary and permissible to safeguard our legitimate interests, and it cannot be assumed that you have an overwhelming legitimate interest in not transferring the data [Art. 6 (1 f) GDPR].

4. Data erasure and storage period

The personal data of the data subject will be deleted or blocked as soon as the purpose of storage no longer applies. In addition, the data can be stored if the European or national legislator has provided for this in Union regulations, laws or other provisions to which the data subject is subject. The data will also be blocked or deleted if a storage period prescribed by the mentioned regulations expires, unless it is necessary for the further storage of the data for the conclusion or fulfilment of a contract.

III. TLS/SSL Encryption

We use a TSL or SSL encryption with the security algorithm SHA-256 bit with RSA encryption to protect your transmitted data. While you can recognize such encrypted connections by the prefix "https://" in the page link in the address line of your browser, unencrypted pages are identified by "http://". The data that you transmit to this website cannot be read by third parties if TSL or SSL encryption is used.

In addition, we make use of suitable technical security measures. In this way we want to protect your data against loss, destruction, manipulation or other unauthorised access.

IV. User is at least 16 years old.

You must be at least 16 years old to use the booking request form, the contact form or the newsletter registration form. If you are under the age of 16, you must obtain prior permission from your parents or legal guardians to complete and submit these forms.

V. Provision of this website and creation of logfiles

Every time you call up our website, our system automatically collects data and information from the computer system of the calling computer or terminal.

The following data is collected and stored in the log files of our system:

Name and URL of the retrieved file; date and time of access; transferred data volume; notification of successful access (HTTP response code); browser type and browser version; operating system; referrer URL (i.e. the previously visited page); Internet service provider of the user; IP address in shortened form and the requesting provider (no clear assignment possible); information about the number of accesses to our website as well as use of individual functions of our Internet presence.

These data are not stored together with other personal data of the user.

The legal basis for the temporary storage of data and log files is Art. 6 (1 f) GDPR.

The temporary storage of the IP address by the system is necessary to enable the website to be delivered to the user's computer. For this purpose, the user's IP address must remain stored for the duration of the session.

The data is stored in log files to ensure the functionality of the website and user-friendly use. The data is also used to optimise the website and to ensure the security of our information technology systems and their stability. An evaluation of the data for marketing purposes does not take place in this context.

These purposes also include our legitimate interest in data processing pursuant to Art. 6 (1 f) GDPR.

The data will be deleted as soon as they are no longer necessary to achieve the purpose for which they were collected. In the case of the collection of data for the provision of the website, this is the case when the respective session has ended.

If the data is stored in log files, this is the case after seven days at the latest. A storage going beyond this is possible. In this case the IP addresses of the users are deleted or altered so that an assignment of the requesting client is no longer possible.

The collection of data for the provision of the website and the storage of data in log files is necessary for the functioning of the website. Therefore, there is no possibility for the user to object.

VI. Newsletter

You can subscribe to a free newsletter on our website. When registering for the newsletter, the data from the input mask is transmitted to us, i.e. the e-mail address of the user.

In addition, the following data is collected during registration:

IP address of the calling computer; date and time of registration; confirmation by the user that he has read the data protection declaration and consent to data processing.

Your consent will be obtained for the processing of your data during the registration process and reference will be made to this data protection declaration.

No data will be transferred to third parties in connection with data processing for the dispatch of newsletters. The data will be used exclusively for the dispatch of the newsletter.

The legal basis for the processing of the data by the user after registration for the newsletter is Art. 6 (1 a) GDPR if the user has given his consent.

The collection of the user's e-mail address serves to deliver the newsletter.

The collection of other personal data as part of the registration process serves to prevent misuse of the services or the e-mail address used.

The data will be deleted as soon as they are no longer required for the purpose for which they were collected. The user's e-mail address will therefore be stored as long as the newsletter subscription is active.

The other personal data collected during the registration process are usually deleted after a period of seven days.

The subscription to the newsletter can be cancelled by the user concerned at any time. For this purpose, there is a corresponding link in every newsletter. Alternatively, you can also send us an e-mail to privacy@impax-tours.com to this effect.

This will also enable you to withdraw your consent to the storage of personal data collected during the registration process.

VII. Use of cookies

Our website uses cookies. Cookies are text files that are stored in the Internet browser or by the Internet browser on the computer system (terminal device) of the user. When a user visits a website, a cookie can be stored on the user's operating system. This cookie contains a characteristic string of characters that enables the browser to be uniquely identified when the website is accessed again. We use cookies to make our website more user-friendly. Some elements of our website require that the accessing browser can be identified even after a page change.

The following data is stored and transmitted in the cookies: Token per page view; language settings; screen display resolution.

We also use cookies on our website which enable us to analyse the surfing behaviour of users (Sections VIII. a-c).

The legal basis for the processing of personal data using cookies is Art. 6 (1 f) GDPR.

The purpose of using technically necessary cookies is to simplify the use of websites for users. Some functions of our website cannot be offered without the use of cookies. For these it is necessary that the browser is recognized also after a page change.

We require cookies for the following applications: ensuring the security of the website; adopting language settings; displaying the website in the correct format.

The user data collected by technically necessary cookies are not used to create user profiles.

Cookies are stored on the user's computer and transmitted to our site by the user. Therefore, you as a user also have full control over the use of cookies. You can deactivate or restrict the transmission of cookies by changing the settings in your Internet browser.

You can access the browser's settings menu via the above links:

Chrome Browser: https://support.google.com/accounts/answer/61416?hl=en

Internet Explorer: https://support.microsoft.com/en-gb/help/17442/windows-internet-explorer-delete-manage-cookies

Mozilla Firefox: https://support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-preferences

Safari: https://support.apple.com/en-gb/guide/safari/manage-cookies-and-website-data-sfri11471/mac

Cookies that have already been saved can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it is possible that all functions of the website can no longer be used to their full extent.

VIII. Analysis and advertising tools

The analysis cookies are used for the purpose of improving the quality of our website and its content. The analysis cookies tell us how the website is used and enable us to constantly optimise our services. In this way, we want to ensure that our online presence is designed to meet the needs of our users. Advertising cookies are used for the purpose of displaying interest-related advertising on other websites to the users of our website. The respective processing purposes and categories of the data are described in more detail in the explanations of this data protection declaration for the different analysis services (Sections VIII. a-c).

Our legitimate interest in the processing of personal data pursuant to Art. 6 (1 f) GDPR also lies in these purposes.

The user data collected in this way are pseudonymised by technical means. It is therefore no longer possible to relate the data to the calling user. The data are not stored together with other personal data of the user.

When calling up our website, users are informed by an information banner about the use of cookies for analysis and advertising purposes and referred to this data protection declaration. In this context, there is also an additional note on how the storage of cookies in the browser settings can be prevented.

a) Google Analytics

This website uses the service "Google Analytics", which is offered by Google Inc. (1600 Amphitheatre Parkway Mountain View, CA 94043, USA, https://www.google.de/intl/en/about/ ), for the analysis of website usage by users of our website. The service uses "cookies" - text files that are stored on your device. The information collected by the cookies is usually sent to a Google server in the USA and stored there. This data might be transferred to third parties if this is legally necessary or if this data is processed on behalf of third parties. With Google's "EU-US Privacy Shield" certification, Google has committed itself to comply with the standards and regulations of European data protection law. Further information can be found at: https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI .

IP anonymisation is used on this website. The IP address of the users is shortened within the member states of the EU and the European Economic Area. This shortening eliminates the personal reference of your IP address. Only in special cases is the IP address shortened after transmission to a Google server in the USA. As part of the agreement on commissioned data processing, which the website operator has concluded with Google Inc., Google uses the information collected to create an evaluation of website usage and analysis of website activity, as well as to provide services associated with Internet usage to ensure a user-friendly and demand-oriented design of the online presence. These purposes also include our legitimate interest in processing the data pursuant to Art. 6 (1 f) GDPR. The following data is collected in this context: Technical information about the user's client device (browser, device terminal, Internet provider, display resolution, language settings); time of access; entered search terms; use of website functions; used operating system; information on how the user came to our website; IP address in shortened form. Your IP address will not be combined with any other data held by Google. You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on point (f) of Article 6(1) GDPR.

You have the option of preventing cookies from being stored on your device by selecting the appropriate settings in your browser. It is not guaranteed that you can access all functions of this website without restrictions if your browser does not permit cookies.

You can also use a browser plug-in to prevent the information collected by cookies (including your IP address) from being sent to Google Inc. and used by Google Inc. The following link leads you to the corresponding plugin: https://tools.google.com/dlpage/gaoptout?hl=en .

You can click on the following link to set an opt-out cookie:

Disable Google Analytics

. An opt-out cookie may be used instead of the browser plug-in or for browsers on mobile devices in order not to be tracked by Google Analytics within this website in the future. This applies only to this browser and only to this domain, as long as the opt-out cookie has not been deleted.

Click here to disable Google Analytics

Here you will find further information on data usage by Google Inc.: https://support.google.com/analytics/answer/6004245?hl=en and at https://policies.google.com/privacy?hl=en&gl=en

b) Google AdWords Conversion Tracking

This website uses the service "Google AdWords" and the "Google Conversion Tracking" ("visit action evaluation"), which is provided by Google Inc. (1600 Amphitheatre Parkway Mountain View, CA 94043, USA) for the purpose of analyzing website usage by users. With Google's "EU-US Privacy Shield" certification, Google has committed itself to complying with the standards and regulations of European data protection law. For more information, please visit: https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI . If you access this website via a Google ad, Google AdWords places a cookie on your computer or terminal device. These cookies are not personally identifiable and are valid for a limited period of time (30 days). If the cookie is valid and you visit certain pages on our site, both Google and we can verify that you clicked on an ad and were directed to this page. Each Google AdWords customer receives a different cookie. These cookies cannot be tracked through AdWords customer websites. AdWords Conversion Tracking customers (like us) receive conversion statistics. The information from these statistics is collected via the conversion cookies. In this way, we receive the total number of users who clicked on one of our ads and were directed to a page with a conversion tracking tag. We cannot personally identify users based on the information provided to us. This enables us to analyse and optimise our advertising measures in terms of their efficiency and to advertise in a targeted manner. These purposes also include our legitimate interest in processing the data in accordance with Art. 6 (1 f) GDPR. You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on point (f) of Article 6(1) GDPR.

You can prevent the storage of the required cookies if you do not wish to participate in the tracking procedure. This is achieved, for example, by deactivating the automatic setting of cookies and deleting Google AdWords cookies already set in the browser settings. Another option for deactivating cookies for conversion tracking is to specify in the browser settings that all cookies from the domain "www.googleadservices.com" are blocked. In addition, at https://support.google.com/ads/answer/2662922?hl=en the Google advertising settings can be changed and thereby personalised advertising can be deactivated for you. Further information on Google's conversion tracking can be found at: https://services.google.com/sitestats/en.html and https://policies.google.com/technologies/ads?hl=en as well as Google's privacy policy at: https://policies.google.com/privacy?gl=en&hl=en-GB . You can also deactivate Google's personalised advertising by using a browser plug-in. The following link will take you to the corresponding plugin: https://support.google.com/ads/answer/7395996?hl=en

c) Google AdWords Remarketing

This website uses the service "Google AdWords Remarketing", which is provided by Google Inc. (1600 Amphitheatre Parkway Mountain View, CA 94043, USA) to present interest-based advertisements on third-party websites or in Google search results. Google sets cookies in the browser of your terminal device to ensure the relevance of the advertisement to your interests. For this purpose, the cookies record the visit to the website as well as anonymous data about the website visitor's use of the website.

If you later visit websites of the Google advertising network, advertisements can be placed that refer to the content of previously visited websites. This processing is based on our legitimate interest pursuant to Art. 6 (1) sentence 1 lit. f GDPR in the placement of interest-related advertisements for visitors of our website on the website of the Google advertising network. In this way, we want to analyse and optimise the marketing of our online presence. You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on point (f) of Article 6(1) GDPR.

With Google's "EU-US Privacy Shield" certification, Google has committed itself to comply with the standards and provisions of European data protection law. Further information can be found at: https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI . You can prevent the storage of cookies required for Google AdWords remarketing if you do not wish to participate in the AdWords remarketing process. One way to disable cookies for Google AdWords remarketing is to set your browser to block all cookies from the "www.googleadservices.com" domain. In addition, at https://support.google.com/ads/answer/2662922?hl=en or at www.google.com/settings/ads/onweb/ the settings for advertising on Google can be changed and deactivated for you personalised advertising. You can also deactivate Google cookies by using a browser plug-in. The following link leads you to the appropriate plugin: https://support.google.com/ads/answer/7395996?hl=en

Further information about Gooogle Adwords Remarketing can be found at: https://policies.google.com/technologies/ads?hl=en-GB and Google's privacy policy at: https://policies.google.com/privacy?gl=en&hl=en-GB .

IX. Contact form, e-mail contact and affiliate request

A contact form is available on our website, which can be used for electronic contact. If a user makes use of this possibility, the data entered in the input mask will be transmitted to us and stored. These data are: Name of the user; e-mail address; message text; confirmation of the user that he/she has read the privacy policy and consent to data processing.

The following data will also be stored at the time the message is sent: The IP address of the user; date and time.

Your consent is obtained for the processing of the data as part of the sending process and reference is made to this privacy policy.

Alternatively, you can contact us via the given e-mail address. In this case, the personal data of the user transmitted with the e-mail will be stored.

In this context, the personal data will not be passed on to third parties. The data will be used exclusively for the processing of the conversation.

The legal basis for the processing of the data is Art. 6 (1 f) GDPR if the user has given his consent.

The legal basis for processing the data transmitted as part of an e-mail is Art. 6 (1 f) GDPR. If the purpose of the e-mail contact is to conclude a contract, the additional legal basis for the processing is Art. 6 (1 b) GDPR. The processing of personal data from the input mask serves us only to process the contact. In the case of contact by e-mail, this also implies the necessary legitimate interest in the processing of the data.

The other personal data processed during the sending process serve to prevent misuse of the contact form and to ensure the security of our information technology systems.

The data are deleted as soon as they are no longer required for the purpose of their collection. For the personal data from the input mask of the contact form and those sent by e-mail, this is the case when the respective conversation with the user is finished. The conversation is finished when it can be seen from the circumstances that the matter in question has been completely clarified.

The additional personal data collected during the sending process will be deleted after a period of seven days at the latest.

The user has the possibility to withdraw his consent to the processing of personal data at any time. If the user contacts us by e-mail, he can object to the storage of his personal data at any time. In such a case, the conversation cannot be continued.

The withdrawal of the consent and the objection of the storage take place via a corresponding message. Please send an e-mail to privacy@impax-tours.com or write to the contact data mentioned under I.

In this case, all personal data stored during the contact will be deleted.

X. Booking request form

There is a booking request form on our website which can be used for the electronic request of a booking. If a user makes use of this possibility, the data entered in the input mask will be transmitted to us and stored. These data are: Name of the user; e-mail address; message text; telephone number; accommodation and room category; arrival and departure dates; number of guests; choice of further services and their number per guest (e.g. transfer, surfboard rental, surf lessons); confirmation of the user that he/she has read the privacy policy and consent to data processing.

At the time the message is sent, the following data will also be stored: the user's IP address; date and time.

Your consent will be obtained for the processing of the data during the sending process and reference will be made to this privacy policy.

The data will only be used to process your booking request. The travel data (accommodation, room category, arrival and departure dates, number of guests, choice of further services and their number per guest) must be forwarded to the travel operator in order to check the availability of corresponding travel requests and to prepare a corresponding offer. These data will be communicated to the travel operator anonymously.

The legal basis for processing the data is Art. 6 (1 a) GDPR if the user has given his consent. The sending of a booking request via the booking request form generally aims at the conclusion of a contract, so that Art. 6 (1 b) GDPR is basically an additional legal basis for the processing.

The processing of personal data from the input mask serves us only to process the booking request. In the case of a booking request by e-mail, this also constitutes the necessary legitimate interest in the processing of the data. Only the travel data (accommodation, room category, arrival and departure dates, number of guests, choice of further services and their number per guest) will be forwarded to the tour operator. In this way, a travel request can be checked for availability and, if necessary, a corresponding offer can be made.

The other personal data processed during the sending process serve to prevent misuse of the contact form and to ensure the security of our information technology systems.

The data are deleted as soon as they are no longer required for the purpose of their collection. For the personal data from the input mask of the booking request form (and those sent by e-mail), this is the case when the conversation with the user about a booking request finish. The conversation is finished when it can be seen under the circumstances that the relevant issue, i.e. the booking request, has been conclusively clarified.

Additional personal data collected during the sending process will be deleted after a period of seven days at the latest.

The user can withdraw his consent to the processing of personal data at any time. The user can object to the storage of his personal data at any time. In such a case, the conversation cannot be continued.

The withdrawal of the consent and the objection of the storage occur via a corresponding message. You can send an e-mail to privacy@impax-tours.com or write to the contact details mentioned under I. In this case, all personal data stored during contact will be deleted.

XI. Cookiebot.com

According to Art. 7 (1) GDPR, we must be able to prove that you have consented to the processing of your personal data. For this purpose, we use the "Cookiebot" from Cybot A/S, Havnegade 39, 1058 Copenhagen, Denmark, for checking the cookie consent and for logging the cookies we use. Within the cookie banner, the various cookies used by this website are categorised, including their functions and duration of effectiveness. By confirming the "Allow all cookies" button or the "OK" button, consent is given to the setting of the listed or user selected cookies and the following data is logged at Cybot: the IP number in anonymous form (the last three digits are set to "0"); date and time of consent; user agent of the browser; the URL from which the consent was submitted; an anonymous, random and encrypted key value; the consent status, serving as proof of consent. The key and consent status are also stored in your browser in the CookieConsent cookie so that the Website can automatically read and respect your consent for all subsequent page requests and future sessions for up to 12 months. The key is used to prove consent and for an option to verify that the consent status stored in your browser is unchanged from the original consent submitted to Cybot. Further information can be found in cookiebot.com's privacy policy at https://www.cookiebot.com/en/privacy-policy/ . Art. 6 (1 f) GDPR is the legal basis for the processing of personal data. Our legitimate interest lies in an intact, problem-free provision of the website. You have the possibility to withdraw your consent to the processing of personal data at any time. You can object to the storage of his personal data at any time. The withdrawal of the consent and the objection of the storage occur via a corresponding notification. You can send an e-mail to privacy@impax-tours.com for this purpose. If you do not want your data to be collected by cookiebot.com, you can install a script blocker for your browser (for example at https://disconnect.me/ or https://www.ghostery.com) or deactivate scripts in your browser settings.

XII.

Rights of the data subject

If your personal data are processed, you are data subject within the meaning of the GDPR and you have the following rights:

1. Right of access

You have the right to obtain from the controller confirmation as to whether personal data concerning you are being processed by us.

In the case of such processing, you have the right to access the following information from the controller:

(1) the purposes for which the personal data are processed;

(2) the categories of personal data processed;

(3) the recipients or categories of recipient to whom the personal data have been or will be disclosed

(4) the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;

(5) the existence of the right to request from the controller rectification or erasure of personal data, the right to restrict the processing by the controller or the right to object to such processing;

(6) the right to lodge a complaint with a supervisory authority;

(7) where the personal data are not collected from the data subject, any available information as to their source

(8) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

You have the right to request information as to whether the personal data concerning you will be transferred to a third country or to an international organisation. In this context, you have the right to request to be informed of the appropriate guarantees pursuant to Art. 46 GDPR in connection with the transfer. The data subject has the right to be informed of the appropriate safeguards pursuant to Article 46 relating to the transfer.

2. Right to rectification

You have the right to have your personal data corrected and/or completed by the controller if the personal data processed concerning you is inaccurate or incomplete. The controller must carry out the rectification immediately.

3. Right to restriction of processing

Under the following conditions, you have the right to request that the processing of your personal data be restricted:

1) if you contest the accuracy of the personal data concerning you for a period of time which allows the controller to verify the accuracy of the personal data;

2) the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;

3) the controller no longer needs the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims, or

4) you have objected to processing pursuant to Article 21(1) GDPR pending the verification whether the legitimate grounds of the controller override those of the data subject.

Where the processing of personal data concerning you has been restricted, such data may not be processed, with the exception of their storage, without your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

If the processing has been restricted in accordance with the above conditions, you are informed by the controller before the restriction of processing is lifted.

4. Right to erasure

a) erasure obligation

You have the right to obtain from the controller the erasure of personal data concerning you without undue delay and the controller has the obligation to erase personal data without undue delay where one of the following grounds applies:

1) the personal data concerning you are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

2) you withdraw consent on which the processing is based according to point (a) of Article 6(1) GDPR, or point (a) of Article 9(2) GDPR, and where there is no other legal ground for the processing;

3) you object to the processing pursuant to Article 21(1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21(2) GDPR;

4) the personal data have been unlawfully processed;

5) the personal data concerning you have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;

6) the personal data concerning you have been collected in relation to the offer of information society services referred to in Article 8(1) GDPR.

b) information to third parties

Where the controller has made the personal data concerning you public and is obliged pursuant to Art. 17 (1) GDPR to erase the personal data, the controller, taking account of available technology and the cost of implementation, has to take reasonable steps, including technical measures, to inform controllers which are processing the personal data that you have requested the erasure by such controllers of any links to, or copy or replication of, those personal data.

c) exceptions

The Right to erasure does not apply to the extent that processing is necessary

(1) for exercising the right of freedom of expression and information;

(2) for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

(3) for reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9(2) as well as Article 9(3) GDPR;

4) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) GDPR in so far as the right referred to in section a) is likely to render impossible or seriously impair the achievement of the objectives of that processing; or

5) for the establishment, exercise or defence of legal claims.

5. Right to be informed

If you have exercised your right to rectify, erase or restrict the processing of your personal data against the controller, the controller is obliged to notify all recipients to whom the personal data concerning you have been made available of this rectification, erasure or restriction, unless this appears impossible or involves a disproportionate effort.

You have the right to be informed of such recipients by the controller.

6. Right to data portability

You have the right to receive the personal data concerning you, which you provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:

(1) the processing is based on consent pursuant to point (a) of Article 6(1) or point (a) of Article 9(2) or on a contract pursuant to point (b) of Article 6(1) GDPR; and

(2) the processing is carried out by automated means.

In exercising this right, you have the right to have the personal data transmitted directly from one controller to another, where technically feasible. Freedoms and rights of others must not be affected adversely by this right.

The right to data portability does not apply to processing personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

7. Right to object

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on point (e) or (f) of Article 6(1) GDPR, including profiling based on those provisions.

The controller no longer processes the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

Where personal data are processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing.

Where you object to processing for direct marketing purposes, the personal data are no longer be processed for such purposes.

In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.

8. Right to withdraw the data protection consent

You have the right to withdraw your data protection consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

9. Automated individual decision-making, including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

This does not apply if the decision:

(1) is necessary for entering into, or performance of, a contract between you and the data controller;

(2) is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or

(3) is based on your explicit consent.

These decisions must not be based on special categories of personal data referred to in Article 9(1) GDPR, unless point (a) or (g) of Article 9(2) GDPR applies and suitable measures to safeguard your rights and freedoms and legitimate interests are in place.

In the cases referred to in sectors (1) and (3), the data controller implements suitable measures to safeguard your rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express the own point of view and to contest the decision.

10. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes this Regulation.

The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant.

XIII. Name and address of the data protection officer

The data protection officer of the controller is Andre Baumunk, Tel.: +49 241 41 250 221 and can be contacted at the address given under I. or via privcacy@impax-tours.com.

XIV Current privacy policy and changes to privacy policy

This is the current privacy policy and is dated May 2018. Due to extensions or changes to our website as well as changed legal or official requirements, it may be necessary to adapt the privacy policy of this website. The current privacy policy, which you can also print out, can always be found at www.impax-tours.com/info/privacy