DATA PROTECTION DECLARATION

 

1. INFORMATION ON THE COLLECTION OF PERSONAL DATA

(1) In the following, we provide information about the collection of personal data when using our website and sub-domains of our website. Personal data is all data that can be related to you personally, e.g. name or address. The data that we may collect from you includes Name, postal address, telephone number, email address, contact preferences, marketing preferences, information about social media accounts and IP address if applicable. You can find out which data we collect and how you use our services in this statement.

(2) When you contact us by email or via a contact form, we store the data you provide (your email address, your name and telephone number if applicable) in order to answer your questions. We delete the data arising in this context after storage is no longer necessary or restrict processing if there are statutory retention obligations.

(3) If we use contracted service providers for individual functions of our offer or would like to use your data for advertising purposes, we will inform you in detail below about the respective processes. We will also state the specified criteria for the storage period.

2 YOUR RIGHTS

(1) You have the following rights vis-à-vis us with regard to your personal data:

- Right of access,

- Right to rectification or erasure,

- Right to restriction of processing,

- Right to object to processing,

- right to data portability.

(2) You also have the right to complain to a data protection supervisory authority about the processing of your personal data by us. https://cnpd.public.lu/de.html

(3) These rights mean:

Right to information

You can request confirmation from the controller as to whether personal data concerning you is being processed by us. If such processing is taking place, you can request the following information from the controller:

- The purposes for which the personal data are processed;

- the categories of personal data being processed

- the recipients or categories of recipients to whom the personal data concerning you have been or will be disclosed

- the envisaged period for which the personal data concerning you will be stored, or, if specific information on this is not possible, the criteria used to determine that period;

- the existence of a right to rectification or erasure of personal data concerning you, a right to restriction of processing by the controller or a right to object to such processing

- the existence of a right to lodge a complaint with a supervisory authority

- all available information about the origin of the data if the personal data is not collected from the data subject

- the existence of automated decision-making, including profiling, referred to in Art. 22 (1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

You have the right to request information as to whether the personal data concerning you is transferred to a third country or to an international organisation. In this context, you may request to be informed of the appropriate safeguards pursuant to Art. 46 GDPR in connection with the transfer.

Right to rectification

You have a right to rectification and/or completion vis-à-vis the controller if the processed personal data concerning you is incorrect or incomplete. The controller must carry out the rectification without undue delay.

Right to restriction of processing

You may request the restriction of the processing of personal data concerning you under the following conditions

- if you contest the accuracy of the personal data concerning you for a period enabling the controller to verify the accuracy of the personal data;

- the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;

- the controller no longer needs the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims, or

- if you have objected to processing pursuant to Art. 21 (1) GDPR pending the verification whether the legitimate grounds of the controller override your grounds.

If the processing of personal data concerning you has been restricted, this data - apart from its storage - may only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

If the restriction of processing has been restricted in accordance with the above conditions, you will be informed by the controller before the restriction is lifted.

Right to cancellation

Obligation to erase You have the right to obtain from the controller the erasure of personal data concerning you without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

- The personal data concerning you, are no longer necessary in relation to the purposes for which they were collected or otherwise processed.

- You revoke your consent on which the processing was based pursuant to Art. 6 para. 1 lit. a or Art. 9 para. 2 lit. a GDPR and there is no other legal basis for the processing.

- You object to the processing pursuant to Art. 21 para. 1 GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21 para. 2 GDPR.

- The personal data concerning you has been processed unlawfully.

- The deletion of personal data concerning you is necessary to fulfil a legal obligation under Union law or the law of the Member States to which the controller is subject.

- The personal data concerning you was collected in relation to information society services offered in accordance with Art. 8 para. 1 GDPR. Information to third parties

If the controller has made the personal data concerning you public and is obliged to erase it pursuant to Art. 17 (1) GDPR, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that you as the data subject have requested the erasure by such controllers of any links to, or copy or replication of, those personal data.

Exceptions to the right to erasure

The right to erasure does not apply if the processing is necessary

- for exercising the right of freedom of expression and information;

- for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller

- for reasons of public interest in the area of public health in accordance with Art. 9 para. 2 lit. h and i and Art. 9 para. 3 GDPR

- for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Art. 89 para. 1 GDPR, insofar as the right referred to in section a) is likely to render impossible or seriously impair the achievement of the objectives of that processing, or

- for the establishment, exercise or defence of legal claims.

Right to information

If you have asserted the right to rectification, erasure or restriction of processing against the controller, the controller is obliged to notify all recipients to whom the personal data concerning you have been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves impossible or involves a disproportionate effort. You have the right vis-à-vis the controller to be informed about these recipients.

Right to data portability

You have the right to receive the personal data concerning you, which you have provided to the controller, in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from the controller to which the personal data has been provided, where

- the processing is based on consent pursuant to Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR   or on a contract pursuant to Art. 6 para. 1 lit. b GDPR and

- the processing is carried out by automated means.

In exercising this right, you also have the right to obtain that the personal data concerning you be transferred directly from one controller to another controller, insofar as this is technically feasible. The freedoms and rights of other persons must not be affected by this.

The right to data portability does not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Right to object

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on point (e) or (f) of Article 6(1) GDPR, including profiling based on those provisions.

The controller will no longer process the personal data concerning you unless the controller demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

If the personal data concerning you are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing.

If you object to processing for direct marketing purposes, the personal data concerning you will no longer be processed for these purposes. You have the option, in connection with the use of information society services - notwithstanding Directive 2002/58/EC - to exercise your right to object by means of automated procedures that use technical specifications.

Right to revoke the declaration of consent under data protection law

You have the right to withdraw your declaration of consent under data protection law at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

3. COLLECTION OF PERSONAL DATA WHEN YOU VISIT OUR WEBSITE

(1) If you use our website for information purposes only, i.e. if you do not register or otherwise provide us with information, we only collect the personal data that your browser transmits to our server.

If you wish to view our website, we collect the following data, which is technically necessary for us to display our website to you and to ensure stability and security (legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR):

- IP address

- Date and time of the enquiry

- Time zone difference to Greenwich Mean Time (GMT)

- Content of the request (specific page)

- Access status/HTTP status code

- Amount of data transferred in each case

- Website from which the request originates

- browser

- Operating system and its interface

- Language and version of the browser software.

(2) The legal basis is Art. 6 para. 1 f) GDPR.

4. COOKIES AND WEB BEACONS

Visit Vianden's websites, advertising, emails and online services use certain technologies for automatic data collection, such as cookies or web beacons. We use these to collect data - including personal data - about you when you use our website or our products or interact with us.

The user data collected helps us to understand the behaviour of our users and tells us what they are looking for on the Internet. It also tells us ,which of our websites users have visited. Cookies are used on our website to distinguish you from other users of our website and to offer you a good user experience when navigating our website. They also provide us with information to improve our website. A cookie is a small piece of data that your web browser stores on your computer's hard drive. When you visit our website, our server recognises the cookie, which provides us with information about your last visit to the website. Many browsers automatically accept cookies; however, you can deactivate this in your browser settings. If you decide not to use cookies, the functionality of our website may be limited for you.

 

Web beacons (also known as tracking pixels or pixel tags) help us to optimise the content of our website by informing us which content is effective. A web beacon is embedded in a website or email and is designed to track user activity on the website or in an email. Like a cookie, a beacon also tracks user visits and sends the associated data to the server. However, unlike a cookie, a beacon cannot be used to identify you and cannot store any data on your computer as it is not browser-based.

Data collected by cookies and similar technologies are treated as non-personal data unless IP addresses (or similar means of identification) are defined as personal data under applicable law.

The legal basis for the use of cookies and web beacons is Art. 6 para. 1 a) and f).

The data is stored for 26 months.

 

5. USE OF GOOGLE ANALYTICS

(1) This website uses Google Analytics, a web analytics service provided by Google Inc ("Google"). Google Analytics uses "cookies", which are text files placed on your computer, to help the website analyse how users use the site. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there. However, if IP anonymisation is activated on this website, your IP address will be shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area beforehand. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. Google will use this information on behalf of the operator of this website to analyse your use of the website, to compile reports on website activity and to provide the website operator with other services relating to website activity and internet usage.

(2) The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.

(3) You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website. You can also prevent Google from collecting the data generated by the cookie and relating to your use of the website (including your IP address) and from processing this data by Google by downloading and installing the browser plug-in available at the following link: http://tools.google.com/dlpage/gaoptout?hl=de.

(4) This website uses Google Analytics with the extension "_anonymiseIp()". This means that IP addresses are further processed in abbreviated form so that they cannot be linked to a specific person. If the data collected about you is personally identifiable, it is immediately excluded and the personal data is deleted immediately.

(5) We use Google Analytics to analyse and regularly improve the use of our website. We can use the statistics obtained to improve our offering and make it more interesting for you as a user. For the exceptional cases in which personal data is transferred to the USA, Google has submitted to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework. The legal basis for the use of Google Analytics is Art. 6 para. 1 sentence 1 lit. f GDPR.2

(6) Information from the third-party provider: Google Dublin, Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001. Terms of use: http://www.google.com/analytics/terms/de.html, overview of data protection: http://www.google.com/intl/de/analytics/learn/privacy.html, as well as the privacy policy: http://www.google.de/intl/de/policies/privacy.

(7) This website also uses Google Analytics for a cross-device analysis of visitor flows, which is carried out via a user ID. You can deactivate the cross-device analysis of your usage in your customer account under "My data", "Personal data"].

(8) The legal basis is Art. 6 para. 1 f).

6.NEWSLETTER

(1) With your consent, you can subscribe to our newsletter, with which we inform you about our current interesting offers. The advertised goods and services correspond to the goods and services that we present on our website.

(2) We use the so-called double opt-in procedure to subscribe to our newsletter. This means that after you have registered, we will send you an email to the email address you have provided in which we ask you to confirm that you wish to receive the newsletter. If you do not confirm your registration within 24 hours, your information will be blocked and automatically deleted after one month. We also store the IP addresses you use and the times of registration and confirmation. The purpose of this procedure is to be able to prove your registration and, if necessary, to clarify any possible misuse of your personal data.

(3) The only mandatory information for sending the newsletter is your e-mail address. After your confirmation, we will save your e-mail address for the purpose of sending you the newsletter. We also store the date of your registration and your IP address. The legal basis is Art. 6 para. 1 sentence 1 lit. a GDPR.

(4) You can revoke your consent to the sending of the newsletter at any time and unsubscribe from the newsletter. You can declare your cancellation by clicking on the link provided in every newsletter e-mail ("unsubscribe"), by e-mail to tourist@vianden.lu. You can also visit the Contact page or our unsubscribe page to unsubscribe from all e-mails.

(5) We would like to point out that we evaluate your user behaviour when sending the newsletter. For this analysis, the e-mails sent contain so-called web beacons or tracking pixels, pixel tags.

For the analyses, we link the data mentioned in Section 5 and the web beacons with your email address and an individual ID. Links received in the newsletter also contain this ID].

We use the data obtained in this way to create a user profile in order to tailor the newsletter to your individual interests. We record when you read our newsletters, which links you click on in them and deduce your personal interests from this. We link this data to the actions you take on our website.

You can object to this tracking at any time by clicking on the separate link provided in each e-mail or by informing us via another contact channel. The information will be stored for as long as you are subscribed to the newsletter. After you unsubscribe, we store the data purely statistically and anonymously.

(6) We store this data for as long as it is required for sending the newsletter. If you unsubscribe, we will delete the data.

(7) The legal basis for the storage is Art. 6 para. 1 a) GDPR.

7. COMMUNICATION AND SUBSCRIPTION SETTINGS

(1) You can decide for yourself what information you receive from Visit Vianden about products and services and how you receive such information by setting your communication preferences on the Contact Us page together with your message or question to us. If you no longer wish to receive marketing information and/or non-transactional emails from us, you can also opt out in this section, click on the unsubscribe link provided in each email or visit the Visit Vianden Contact Us page to leave unsubscribe information. However, please note that this setting does not apply to transactional business emails between Visit Vianden and the user.

(2) If you do not wish to provide certain personal data, we may not be able to respond fully or adequately to your requests, provide updates and/or inform you about our products and services. You can unsubscribe from certain types of emails at any time using the opt-out process. Click on the "unsubscribe" link that you will find in every email or go to the Visit Vianden Contact Us page. In either case, however, we will use your personal information to send you important notices about products and changes to our policies and agreements, or for other purposes permitted by law