Data Protection Policy
Data Protection Policy:
(English Version: In case
of any variance between the English and German versions, the German version
(Datenschutzerklärung) shall prevail).
1) Information on the
collection of personal data and contact details of the controller
The controller responsible for data
processing on this website within the meaning of the General Data Protection
Regulation (GDPR) is
Glampingwelt
GmbH
Jacquingasse
13/1
1030
Vienna
Austria
Tel:
+43(0)6765562542,
Email: info@glampingwelt.com
2) Data collection when
visiting our website
If you only use our website for information
purposes, i.e. if you do not register or otherwise provide us with information,
we only collect the data that your browser transmits to our server (so-called
"server log files"). When you access our website, we collect the
following data, which is technically necessary for us to display the website to
you:
·
The visited website
· Date and time at the time of access
· Amount of data sent in bytes
· Source/reference from which you reached the page
·
Browser used
·
Operating system used
· IP address used (if applicable: in anonymised form)
Processing is carried out in accordance with
Art. 6 para. 1 lit. f GDPR on the basis of our legitimate interest in improving
the stability and functionality of our website. The data will not be passed on
or used in any other way.
3) Hosting
Hosting by Shopify: We use the shop system of
the service provider Shopify International Limited, Victoria Buildings, 2nd
Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland ("Shopify"),
for the purpose of hosting and displaying the online shop on the basis of
processing on our behalf. All data collected on our website is processed on
Shopify's servers. As part of Shopify's aforementioned services, data may also
be transferred to Shopify Inc, 150 Elgin St, Ottawa, ON K2P 1L4, Canada,
Shopify Data Processing (USA) Inc, Shopify Payments (USA) Inc or Shopify (USA)
Inc as part of further processing on our behalf. In the event that data is
transferred to Shopify Inc. in Canada, the appropriate level of data protection
is guaranteed by an adequacy decision of the European Commission. Shopify Data
Processing (USA) Inc., Shopify Payments (USA) Inc. and Shopify (USA) Inc. in
the USA are certified for the US-European data protection agreement
"Privacy Shield", which guarantees compliance with the level of data
protection applicable in the EU.
Further information on Shopify's data protection can be found on the following
website: https://www.shopify.de/legal/datenschutz
Any further processing on Shopify servers other than those mentioned above only
takes place within the framework specified below.
4) Cookies
In order to make visiting our website
attractive and to enable the use of certain functions, we use so-called cookies
on various pages. These are small text files that are stored on your end
device. Some of the cookies we use are deleted again at the end of the browser
session, i.e. after you close your browser (so-called session cookies). Other
cookies remain on your end device and enable your browser to be recognised the
next time you visit (persistent cookies). If cookies are set, they collect and
process certain user information such as browser and location data as well as
IP address values to an individual extent. Persistent cookies are automatically
deleted after a specified period, which may vary depending on the cookie. The
duration of the respective cookie storage can be found in the overview of the
cookie settings of your web browser.
In some cases, cookies are used to simplify
the ordering process by saving settings (e.g. remembering the contents of a
virtual shopping basket for a later visit to the website). If personal data is
also processed by individual cookies used by us, the processing is carried out
in accordance with Art. 6 para. 1 lit. b GDPR either for the execution of the
contract, in accordance with Art. 6 para. 1 lit. a GDPR in the case of consent
given or in accordance with Art. 6 para. 1 lit. f GDPR to safeguard our legitimate
interests in the best possible functionality of the website and a
customer-friendly and effective design of the page visit.
Please note that you can set your browser so
that you are informed about the setting of cookies and can decide individually
whether to accept them or to exclude the acceptance of cookies for certain
cases or in general. Each browser differs in the way it manages cookie
settings. This is described in the help menu of each browser, which explains
how you can change your cookie settings. These can be found for the respective
browsers under the following links:
Internet Explorer: https://support.microsoft.com/de-de/help/17442/windows-internet-explorer-delete-manage-cookies
Firefox: https://support.mozilla.org/de/kb/cookies-erlauben-und-ablehnen
Chrome: https://support.google.com/chrome/answer/95647?hl=de&hlrm=en
Safari: https://support.apple.com/de-de/guide/safari/sfri11471/12.0/mac/10.14
Opera: https://help.opera.com/de/latest/web-preferences/#cookies
Please note that if you do not accept
cookies, the functionality of our website may be restricted.
5) Contacting us
Personal data is collected when you contact
us (e.g. via contact form or email). Which data is collected in the case of a
contact form can be seen from the respective contact form. This data is stored
and used exclusively for the purpose of responding to your enquiry or for
contacting you and the associated technical administration. The legal basis for
the processing of this data is Art. 6 para. 1 lit. b GDPR (necessary to take
steps at the request of the data subject prior to entering into a contract).
Your data will be deleted after final processing of your enquiry. This is the
case if it can be inferred from the circumstances that the matter in question
has been conclusively clarified and provided that there are no statutory
retention obligations to the contrary.
6) Data processing when
opening a customer account and for contract processing
In accordance with Art. 6 para. 1 lit. b
GDPR, personal data will continue to be collected and processed if you provide
it to us for the fulfilment of a contract or when opening a customer account.
Which data is collected can be seen from the respective input forms. We store
and use the data provided by you to fulfil the contract. After completion of
the contract or deletion of your customer account, your data will be deleted
with regard to tax and commercial law retention periods (currently 7 years),
unless you have expressly consented to further use of your data or a legally
permitted further use of data has been reserved by us.
7) Use of your data for
direct marketing
7.1 Subscription to our e-mail newsletter
If you subscribe to our e-mail newsletter, we will
send you regular information about our offers. The only mandatory information
for sending the newsletter is your e-mail address. The provision of further
data is voluntary and is used to address you personally.
By subscribing, you give us your consent to the use
of your personal data in accordance with Art. 6 para. 1 lit. a GDPR. When you
register for the newsletter, we store your IP address entered by the Internet
Service Provider (ISP) as well as the date and time of registration in order to
be able to trace any possible misuse of your e-mail address at a later date.
The data collected by us when you register for the newsletter will be used
exclusively for the purpose of advertising by means of the newsletter. You can
unsubscribe from the newsletter at any time using the link provided in the
newsletter or by sending us a corresponding message. Once you have cancelled
your subscription, your e-mail address will be deleted from our newsletter
mailing list immediately.
7.2 Newsletter dispatch via MailChimp
Our email
newsletters are sent via this provider: The Rocket Science Group, LLC d/b/a
MailChimp, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA
On the basis of our legitimate interest in effective
and user-friendly newsletter marketing, we pass on the data you provide when
registering for the newsletter to this provider in accordance with Art. 6 para.
1 lit. f GDPR so that they can send the newsletter on our behalf.
Subject to your express consent pursuant to Art. 6
para. 1 lit. a GDPR, the provider also carries out a statistical evaluation of
the success of newsletter campaigns using web beacons or tracking pixels in the
e-mails sent, which can measure opening rates and specific interactions with
the content of the newsletter. End device information (e.g. time of access, IP
address, browser type and operating system) is also collected and analysed, but
not merged with other data sets.
You can revoke your consent to newsletter tracking at
any time with effect for the future.
We have concluded an order processing contract with
the provider, which protects the data of our website visitors and prohibits
disclosure to third parties.
For data transfers to the USA, the provider has signed
up to the EU-US Data Privacy Framework, which ensures compliance with the
European level of data protection on the basis of an adequacy decision by the
European Commission.
8) Data processing for
order processing
8.1 In order to process your
order, we work together with the following service provider(s), who support us
in whole or in part in the fulfilment of concluded contracts. Certain personal
data is transmitted to these service providers in accordance with the following
information.
The personal data collected by us will be
passed on to the transport company commissioned with the delivery as part of
the contract processing, insofar as this is necessary for the delivery of the
goods. We pass on your payment data to the commissioned credit institution
within the scope of payment processing, insofar as this is necessary for
payment processing. If payment service providers are used, we will inform you
of this explicitly below. The legal basis for the transfer of data is Art. 6
para. 1 lit. b GDPR.
8.2 Transfer of personal data
to shipping service providers
- Lagermax Wien
Internationale Spedition GmbH
If the goods are delivered by the transport
service provider Lagermax (Lagermax Wien Internationale Spedition GmbH,
Ailecgasse 36, 1110 Vienna), we will pass on your telephone number to Lagermax before
delivery of the goods in accordance with Art. 6 para. 1 lit. a GDPR for the
purpose of coordinating a delivery date or for delivery notification, provided
that you have given your express consent to this in the ordering process.
Otherwise, we will only pass on the name of the recipient and the delivery
address to Lagermax for the purpose of delivery in accordance with Art. 6 para.
1 lit. b GDPR. The data will only be passed on if this is necessary for the
delivery of goods. In this case, prior coordination of the delivery date with
Hermes or the transmission of status information of the shipment delivery is
not possible.
Consent can be revoked at any time with effect for the future vis-à-vis us or the
transport service provider Lagermax.
- Austrian Post
If the goods are delivered by the transport service provider
Österreichische Post (Österreichische Post Aktiengesellschaft, Rochusplatz 1,
1030 Vienna, Austria), we will pass on your e-mail address to Österreichische
Post before delivery of the goods in accordance with Art. 6 para. 1 lit. a GDPR
for the purpose of coordinating a delivery date or for delivery notification,
provided that you have given your express consent to this in the ordering
process. Otherwise, we will only pass on the name of the recipient and the
delivery address to Austrian Post for the purpose of delivery in accordance
with Art. 6 para. 1 lit. b GDPR. The information will only be passed on if this
is necessary for the delivery of goods. In this case, prior coordination of the
delivery date with Austrian Post or the transmission of status information of
the shipment delivery is not possible.
Consent can be revoked at any time with effect for the future by contacting us or
the transport service provider Austrian Post.
- DHL
If the goods are delivered by the transport service provider DHL (DHL Paket
GmbH, Sträßchensweg 10, 53113 Bonn, Germany), we will pass on your e-mail
address to DHL before delivery of the goods in accordance with Art. 6 para. 1
lit. a GDPR for the purpose of coordinating a delivery date or for delivery
notification, provided that you have given your express consent to this in the
ordering process. Otherwise, we will only pass on the name of the recipient and
the delivery address to DHL for the purpose of delivery in accordance with Art.
6 para. 1 lit. b GDPR. The data will only be passed on if this is necessary for
the delivery of goods. In this case, prior coordination of the delivery date
with DHL or the transmission of status information of the shipment delivery is
not possible.
Consent can be revoked at any time with future effect vis-à-vis us or vis-à-vis
the transport service provider DHL.
- DPD
If the goods are delivered by the transport
service provider DPD (DPD Deutschland GmbH, Wailandtstraße 1, 63741
Aschaffenburg), we will pass on your e-mail address and telephone number to DPD
before delivery of the goods in accordance with Art. 6 para. 1 lit. a GDPR for
the purpose of coordinating a delivery date or for delivery notification,
provided that you have given your express consent to this during the ordering
process. Otherwise, we will only pass on the name of the recipient and the
delivery address to DPD for the purpose of delivery in accordance with Art. 6
Para. 1 lit. b GDPR. The data will only be passed on if this is necessary for
the delivery of goods. In this case, prior coordination of the delivery date
with DPD or notification of delivery is not possible.
Consent can be withdrawn at any time
with effect for the future from the controller named above or from the
transport service provider DPD.
8.3 Use of payment service
providers (payment services)
- PayPal
When paying via PayPal, credit card via
PayPal, direct debit via PayPal or - if offered - "purchase on
account" or "payment by instalments" via PayPal, we pass on your
payment data to PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal,
L-2449 Luxembourg (hereinafter "PayPal"), as part of the payment
processing. The transfer takes place in accordance with Art. 6 para. 1 lit. b
GDPR and only insofar as this is necessary for payment processing.
PayPal reserves the right to carry out a
credit check for the payment methods credit card via PayPal, direct debit via
PayPal or - if offered - "purchase on account" or "payment by
instalments" via PayPal. For this purpose, your payment data may be passed
on to credit agencies
in accordance with Art. 6 para. 1 lit. f GDPR on the basis of PayPal's
legitimate interest in determining your solvency. PayPal uses the result of the
credit check with regard to the statistical probability of non-payment for the
purpose of deciding on the provision of the respective payment method. The
credit report may contain probability values (so-called score values). If score
values are included in the result of the credit report, they are based on a
scientifically recognised mathematical-statistical procedure. The calculation
of the score values includes, but is not limited to, address data. Further data
protection information, including information on the credit agencies used, can
be found in PayPal's privacy policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full
You can object to this processing of your data at any time by sending a message
to PayPal. However, PayPal may still be authorised to process your personal
data if this is necessary for contractual payment processing.
- SOFORT
If you select the "SOFORT" payment
method, payment will be processed via the payment service provider SOFORT GmbH,
Theresienhöhe 12, 80339 Munich, Germany (hereinafter "SOFORT"), to
whom we will pass on the information you provided during the ordering process
together with the information about your order in accordance with Art. 6 para.
1 lit. b GDPR. Sofort GmbH is part of the Klarna Group (Klarna Bank AB (publ),
Sveavägen 46, 11134 Stockholm, Sweden). Your data will only be passed on for
the purpose of payment processing with the payment service provider SOFORT and
only to the extent that it is necessary for this purpose. You can obtain
further information about SOFORT's data protection provisions at the following
Internet address: https://www.klarna.com/sofort/datenschutz
- KLARNA
One or more online payment
methods from the following provider are available on this website: Klarna Bank
AB, Sveavägen 46, 111 34 Stockholm, Sweden
If you select a payment method of the provider for
which you make an advance payment (such as credit card payment), the payment
data you provide during the ordering process (including name, address, bank and
payment card information, currency and transaction number) as well as
information about the content of your order will be passed on to the provider
in accordance with Art. 6 para. 1 lit. b GDPR. In this case, your data will
only be passed on for the purpose of payment processing with the provider and
only to the extent that it is necessary for this purpose.
If you select a payment method for which the provider
makes an advance payment (such as invoice or instalment purchase or direct
debit), you will also be asked to provide certain personal data (first and last
name, street, house number, postcode, city, date of birth, e-mail address,
telephone number, possibly data on an alternative means of payment) during the
order process.
In order to safeguard our legitimate interest in
determining the solvency of our customers, this data is forwarded by us to the
provider for the purpose of a credit check in accordance with Art. 6 para. 1
lit. f GDPR. On the basis of the personal data provided by you and other data
(such as shopping basket, invoice amount, order history, payment experience),
the provider checks whether the payment option you have selected can be granted
with regard to payment and/or bad debt risks.
In addition to internal provider criteria pursuant to
Art. 6 para. 1 lit. f GDPR, identity and creditworthiness information from the
following credit agencies may also be included in the decision as part of the
application review:
https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_de/credit_rating_agencies
The credit report may contain probability values
(so-called score values). If score values are included in the result of the
credit report, they are based on a scientifically recognised
mathematical-statistical procedure. The calculation of the score values
includes, but is not limited to, address data.
You can object to
this processing of your data at any time by sending a message to us or to the
provider. However, the provider may still be authorised to process your
personal data if this is necessary to process payments in accordance with the
contract.
9) Contact for feedback
request
Own feedback reminder (no dispatch by a
customer evaluation system)
We use your e-mail address for a one-off reminder to submit an evaluation of
your order for the evaluation system we use, provided that you have given us
your express consent to do so during or after your order in accordance with
Art. 6 para. 1 lit. a GDPR.
You can revoke your consent at any time by sending a message to the data controller.
10) Online marketing
Google AdSense
This website uses Google AdSense, a web advertising
service Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5,
Ireland ("Google"). Google AdSense uses cookies, which are text files
placed on your computer, to help the website analyse how users use the site. In
addition, Google AdSense also uses so-called "web beacons" (small
invisible graphics) to collect information, through the use of which simple
actions such as visitor traffic on the website can be recorded, collected and
analysed. The information generated by the cookie and/or web beacon (including
your IP address) about your use of this website is usually transmitted to a
Google server and stored there. This may also involve transmission to the
servers of Google LLC. in the USA.
Google uses the information obtained in this way to
evaluate your usage behaviour with regard to the AdSense ads. The IP address
transmitted by your browser as part of Google AdSense will not be merged with
other Google data. The information collected by Google may be transferred to
third parties if this is required by law and/or if third parties process this
data on behalf of Google.
All processing described above, in particular the reading of information on the
end device used via cookies and/or web beacons, will only be carried out if you
have given
us your express consent to do so
in accordance with Art. 6 para. 1 lit. a GDPR. Without this consent, Google
AdSense will not be used during your visit to our website.
You can revoke your consent at any time with effect
for the future by deactivating this service in the "cookie consent
tool" provided on the website.
For data transfers to the USA, the provider has
signed up to the EU-US Data Privacy Framework, which ensures compliance with
the European level of data protection on the basis of an adequacy decision by
the European Commission.
Google's privacy policy can be viewed here: https://www.google.de/policies/privacy/
11) Web analysis
services
Google Analytics 4
This website uses Google Analytics 4, a web analysis service
of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland
("Google"), which enables your use of our website to be analysed.
By default, Google Analytics sets 4 cookies when you
visit the website, which are stored as small text modules on your end device
and collect certain information. The scope of this information also includes
your IP address, which, however, is shortened by Google by the last digits in
order to exclude a direct personal reference.
The information is transferred to Google servers and
processed there. Transmission to Google LLC, based in the USA, is also
possible.
Google uses the information collected on our behalf to
analyse your use of the website, to compile reports on website activity for us
and to provide other services relating to website activity and internet usage.
The abbreviated IP address transmitted by your browser as part of Google
Analytics will not be merged with other Google data. The data collected as part
of the use of Google Analytics 4 is stored for a period of two months and then
deleted.
All processing
described above, in particular the setting of cookies on the terminal device
used, will only take place if you have given us your express consent to do so
in accordance with Art. 6 para. 1 lit. a GDPR.
Without your consent, Google Analytics 4
will not be used during your visit to our website. You can revoke your consent
at any time with effect for the future. To exercise your right of cancellation,
please deactivate this service using the "cookie consent tool"
provided on the website.
We have concluded an order processing contract with
Google, which ensures the protection of the data of our website visitors and
prohibits unauthorised disclosure to third parties.
Further legal
information on Google Analytics 4 can be found at https://policies.google.com/privacy?hl=de&gl=de and at https://policies.google.com/technologies/partner-sites
Demographic characteristics
Google Analytics 4 uses the special function "demographic
characteristics" and can use it to create statistics that make statements
about the age, gender and interests of site visitors. This is done by analysing
advertising and information from third-party providers. This allows target
groups to be identified for marketing activities. However, the data collected
cannot be assigned to a specific person and is deleted after being stored for a
period of two months.
Google Signals
As an
extension to Google Analytics 4, Google Signals can be used on this website to
generate cross-device reports. If you have activated personalised ads and have
linked your devices to your Google account, Google can analyse your usage
behaviour across devices and create database models, including for cross-device
conversions, subject to your consent to the use of Google Analytics in
accordance with Art. 6 para. 1 lit. a GDPR. We do not receive any personal data
from Google, only statistics. If you want to stop the cross-device analysis,
you can deactivate the "Personalised advertising" function in the
settings of your Google account. To do this, follow the instructions on this
page: https://support.google.com/ads/answer/2662922?hl=de You can find more
information about Google Signals at the following link: https://support.google.com/analytics/answer/7532985?hl=de
UserIDs
As an
extension to Google Analytics 4, the "UserIDs" function can be used
on this website. If you have consented to the use of Google Analytics 4 in
accordance with Art. 6 para. 1 lit. a GDPR, have set up an account on this
website and log in with this account on different devices, your activities,
including conversions, can be analysed across devices.
For data transfers to the USA, the provider has signed
up to the EU-US Data Privacy Framework, which ensures compliance with the
European level of data protection on the basis of an adequacy decision by the
European Commission.
12) Rights of the
data subject
12.1 The applicable data protection law grants you
comprehensive data subject rights vis-à-vis the controller with regard to the
processing of your personal data, about which we inform you below:
§ Right to information in accordance with Art. 15
GDPR: In particular, you have the right to information about your personal data
processed by us, the purposes of processing, the categories of personal data
processed, the recipients or categories of recipients to whom your data has
been or will be disclosed, the planned storage period or the criteria for
determining the storage period, the existence of a right to rectification,
erasure, restriction of processing, objection to processing, complaint to a supervisory
authority, the origin of your data if it was not collected by us from you, the
existence of automated decision-making including profiling and, if applicable,
meaningful information on the logic involved and the scope and intended effects
of such processing on you, as well as your right to be informed of the
guarantees pursuant to Art. 46 GDPR if your data is transferred to third
countries;
§ Right to rectification pursuant to Art. 16 GDPR:
You have a right to immediate rectification of incorrect data concerning you
and/or completion of your incomplete data stored by us;
§ Right to erasure in accordance with Art. 17 GDPR:
You have the right to request the erasure of your personal data if the
requirements of Art. 17 (1) GDPR are met. However, this right does not apply in
particular if the processing is necessary for exercising the right of freedom
of expression and information, for compliance with a legal obligation, for
reasons of public interest or for the establishment, exercise or defence of
legal claims;
§ Right to restriction of processing in accordance
with Art. 18 GDPR: You have the right to request the restriction of the
processing of your personal data as long as the accuracy of your data, which
you dispute, is verified, if you refuse to delete your data due to unauthorised
data processing and instead request the restriction of the processing of your
data, if you need your data for the assertion, exercise or defence of legal
claims after we no longer need this data after the purpose has been achieved or
if you have lodged an objection for reasons of your particular situation, as
long as it is not yet clear whether our legitimate reasons prevail;
§ Right to information in accordance with Art. 19
GDPR: If you have asserted the right to rectification, erasure or restriction
of processing against the controller, the controller is obliged to notify all
recipients to whom the personal data concerning you have been disclosed of this
rectification or erasure of the data or restriction of processing, unless this
proves impossible or involves a disproportionate effort. You have the right to
be informed about these recipients.
§ Right to data portability pursuant to Art. 20 GDPR:
You have the right to receive your personal data that you have provided to us
in a structured, commonly used and machine-readable format or to request that
it be transmitted to another controller, insofar as this is technically
feasible;
§ Right to withdraw consent granted in accordance
with Art. 7 (3) GDPR: You have the right to withdraw your consent to the
processing of data at any time with effect for the future. In the event of
revocation, we will delete the data concerned immediately, unless further
processing can be based on a legal basis for processing without consent. The
withdrawal of consent shall not affect the lawfulness of processing based on
consent before its withdrawal;
§ Right to lodge a complaint pursuant to Art. 77
GDPR: If you believe that the processing of your personal data violates the
GDPR, you have the right - without prejudice to any other administrative or
judicial remedy - to lodge a complaint with a supervisory authority, in Austria
the data protection authority
12.2 Right of objection
If your personal data is
processed on the basis of our overriding interest, you have the right to object
to this processing at any time with effect for the future. However, we reserve
the right to further processing if there are compelling reasons for further
processing.
13) Duration of
storage of personal data
The
duration of the storage of personal data is determined by the respective legal
basis, the purpose of processing and - if relevant - additionally by the
respective statutory retention period (e.g. retention periods under company and
tax law).
When
processing personal data on the basis of express consent in accordance with
Art. 6 para. 1 lit. a GDPR, this data is stored until the data subject
withdraws their consent.
If
there are statutory retention periods for data that is processed within the
framework of legal or similar obligations on the basis of Art. 6 para. 1 lit. b
GDPR, this data will be routinely deleted after the retention periods have
expired, provided that it is no longer required for contract fulfilment or
contract initiation and/or we no longer have a legitimate interest in further
storage.
When
processing personal data for the purpose of direct marketing on the basis of
Art. 6 para. 1 lit. f GDPR, this data is stored until the data subject
exercises their right to object in accordance with Art. 21 para. 2 GDPR.
Unless
otherwise stated in the other information in this declaration on specific
processing situations, stored personal data is deleted when it is no longer
necessary for the purposes for which it was collected or otherwise processed.