4.1 Booking a trip

• • • Last name, first name, gender
    • Date of birth
    • Address (country, postal code, city, street, house number)
    • Telephone (landline, mobile)
    • Email address
    • Skill (surfing experience)
    • Possibly “vegetarian”

The processing is for handling pre-contractual/contractual relationships according to Art. 6 (1) (b) GDPR required

4.1 Payment by direct debit

• • • Account owner
    • IBAN
    • BIC

The processing is for handling pre-contractual/contractual relationships according to Art. 6 (1) (b) GDPR required

4.2 Insurance

• • • Last name, first name
    • Date of birth
    • Booking date
    • Booking number

The processing and forwarding of the data is required for the settlement of pre-contractual/contractual relationships according to Art.6 (1) (b) GDPR.

4.3 Contest

• • • Last name, first name
    • Date of birth
    • Address (country, postal code, city, street, house number)
    • Telephone (landline, mobile)
    • Email address

The processing takes place on the basis of consent according to Art.6 (1) (a) GDPR

4.4 Newsletter

• • • Email address
    • Last name (optional)
    • First name (optional)

When you subscribe to the newsletter, we collect and process your data for the compilation of the contents as well as the dispatch on the basis of consent according to Art.6 (1) (a) GDPR

4.5 Contact form

We offer you the opportunity to contact us by email and/or via our website contact form. In this case, the information provided by the user will be stored for the purpose of processing their contact. Transfer to third does not take place. A comparison of the data collected with data which may be collected by other components of our site also does not occur.

The processing takes place on the basis of consent according to Art.6 (1) (a) GDPR

Please note that if bookings are made for more than one person, personal data of fellow travellers can also be collected. You should therefore ensure that all information relating to third parties is entered by you only with the consent of such persons.

When reserving or booking a tourism service, we use your personal data in the context of the purpose of the contractual relationship to broker the product and to process the associated services.

In the collection, processing and use of your personal data for advertising or market research purposes, of course, we comply with the statutory provisions (legitimate interest Art.6 (1) (f) GDPR). You may object to such use of your data at any time. Whenever we use your data for advertising, market or opinion-research purposes, we will point out to you that you have the opportunity to object at any time or we will provide a simple way to unsubscribe (e.g. as a link).

5. Disclosure of data

We will forward your personal data to the respective contractual partner for the execution and processing of the tourism services provided by us. The legal basis here is Art. 6 91) (f) GDPR.

5.1 Other tour operators

If we do not carry out our own trips, but instead broker them to other companies, we transmit the data required for the contract execution with these companies.

5.2 Airlines

When we book flights for our customers as part of a trip, the data required for the flight booking is transmitted to the airline

5.4 Travel insurance

If travel insurance is taken out as part of the booking, we will send the necessary data to the insurance company.

If you participate in contests, we will pass on your data to the respective contest partners, as far as this is necessary for the redemption of a win.

If you subscribe to a newsletter, we forward personal data to our service provider (Mail-Chimp).

When you use the online services, we pass on your data to our online system service providers (Hetzner Online GmbH), web analytics service providers (google-analytics) and marketing service providers (morefire GmbH), so that we can constantly improve our offers and services for you.

In accordance with the statutory provisions, we will only forward personal data in cases when and to the extent that this is necessary for the processing of your booking or the related payment process.

We only forward personal data to state institutions and authorities if there are compulsory legal requirements in this regard. The transfer of personal data, in particular addresses, to third parties expressly does not take place.

In order to process your personal data as securely as possible, we generally use the SSL (Secure Socket Layer) security software for the transfer of data between your computer and our server, especially when booking a tourism service provided by us.

The widespread SSL (Secure Socket Layer) method combined with the highest encryption level supported by your browser ensures a high degree of data security. In general, this is a 256-bit encryption. If your browser does not support 256-bit encryption, 128-bit v3 technology is used instead. This leads to the fact that the data transmission takes place in each case in encrypted form. Whether a single page of our website is transmitted in encrypted form is indicated by the representation of the closed key or lock symbol in the lower status bar of your browser.

In addition, the website uses appropriate technical and organisational security measures to protect your data against accidental or intentional manipulation, partial or complete loss or destruction, or against unauthorised access by third parties. Our security measures are continuously improved in line with technological developments.

The storage of your personal data takes place exclusively in compliance with the legal regulations within the Federal Republic of Germany. Insofar as pseudonymised data is processed and stored in the USA, this is done on the basis of approved contractual regulations (see point 8).

Insofar as we forward data to our service providers within the framework of the services described here, they are bound to contractual requirements with us in addition to the mandatory statutory provisions with regard to data protection.

The use of our website is possible without provision of personal data. Different regulations may apply to the use of individual services on our site, which will be explained separately in this case below. Your personal data (e.g. name, address, email, telephone number, IP address, etc.) is processed by us only in accordance with the provisions of German and EU data protection law.

6. STORAGE DURATION

Unless explicitly stated in this privacy policy, the data stored by us will be deleted as soon as it is no longer necessary for its intended purpose and the deletion does not conflict with any statutory retention requirements. The criterion for the duration of the storage of personal data is the respective statutory retention period. After the deadline, the corresponding data will be routinely deleted, if it is no longer required to fulfil the contract or to initiate a contract.

We offer you the opportunity to register on our site. The data entered in the course of this registration, which can be seen from the input mask of the registration form (name, email address, gender, street, country, zip code, city, telephone, mobile, date of birth, surfskill) is collected and stored exclusively for the use of our offer. When you register on our site, we will also store your IP address and the date and time of your registration. In the event that a third party abuses your data and registers on our site with this data without your knowledge this serves as security on our part. Transfer to third does not take place. A comparison of the data collected with data which may be collected by other components of our site also does not occur.

We offer you the opportunity to register on our site for our newsletter. We provide information about our offers in regular intervals with this newsletter. To receive our newsletter you need a valid email address. We will check the email address you entered to verify that you are the owner of the specified email address or the owner authorises reception of the newsletter. When you register for our newsletter, we will save your IP address and the date and time of your registration. In the event that a third party abuses your email address and registers for our newsletter without your knowledge, this serves as security on our part. Further data will not be collected on our part. The data collected in this way will be used exclusively to obtain our newsletter. Transfer to third does not take place. A comparison of the data collected with data which may be collected by other components of our site also does not occur. You can cancel the subscription to this newsletter at any time. Details can be found in the confirmation email as well as in each individual newsletter.

According to § 7 (3) UWG (GDPR) the email address will be transferred directly into the newsletter list after booking in order to provide information about booking relevant contents or similar products. If this is not desired there is the possibility to deselect this.

We offer you the opportunity to contact us by email and/or via our website contact form. In this case, the information provided by the user will be stored for the purpose of processing their contact. Transfer to third does not take place. A comparison of the data collected with data which may be collected by other components of our site also does not occur.

7. COOKIES

We use cookies on our site. These are small files that your browser automatically creates and that are stored on your device (laptop, tablet, smartphone, etc.) when you visit our site. Cookies do not harm your device and do not contain viruses, Trojans or other malicious software. Information is stored in the cookie, which in each case results in connection with the specific device used. However, this does not mean that we are immediately aware of your identity. On the one hand, the use of cookies serves to make the use of our offer more pleasant for you. For example, we use so-called session cookies to recognise that you have already visited individual pages on our website. These are automatically deleted after leaving our website. In addition, to improve usability, we also use temporary cookies, which are stored on your device for a specified period of time. If you visit our site again to use our services, it will automatically recognise that you have already been with us and what inputs and settings you have made, so you do not have to re-enter them.

On the other hand, we use cookies to statistically record the use of our website and to evaluate it for the purpose of optimising our offer for you. These cookies allow us to automatically recognise when you visit our site again that you have already been with us. These cookies are automatically deleted after a defined time.

The data processed by cookies is required for the purposes mentioned in order to safeguard our legitimate interests as well as those of third parties pursuant to Art. 6 (1) (f) GDPR. Most browsers accept cookies automatically. However, you can configure your browser so that no cookies are stored on your computer or a notice always appears before a new cookie is stored. However, disabling cookies completely may mean that you cannot use all features of our website.

The possibility to reject cookies, also for web tracking, is provided in the settings of your web browser. You can set your web browser so you are notified when cookies are set or so cookies are rejected in general. However, you may not be able to use all features of our website without errors in this case. Use the links below to find out about this option for the most popular browsers:

• Microsoft Explorer: https://support.microsoft.com/­de-de/help/17442/windows-internet­-explorer-delete-manage-cookies  

• Mozilla Firefox: https://support.mozilla.org/­de/kb/Cookies-blockieren 

• Google Chrome: https://support.google.com/­chrome/answer/95647?co=GENIE.­Platform%3DDesktop&hl=de 

• Safari: https://support.apple.com/kb/­ph21411?locale=­de_DE

8. Web analytics  

Use of Google Analytics with anonymisation function

We use Google Analytics, a web analysis service of Google Inc., 1600 Amphitheater Parkway, Mountain View, CA 94043 USA, hereafter “Google”. Google Analytics uses so-called “cookies”, which are text files that are stored on your computer and that allow an analysis of the use of the website by you.

The information generated by these cookies, such as the time, location and frequency of your website visit, including your IP address, is transmitted to Google in the United States and stored there.

We use Google Analytics on our website with an IP anonymisation feature. In this case, your IP address will already be shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area and thereby anonymised.

Google will use this information to evaluate your use of our site, to compile reports on website activity for us, and to provide other services related to website activity and internet usage. Google may also transfer this information to third parties if required by law or as far as third parties process this data on behalf of Google.

According to Google’s own statements, Google does not link your IP address to other Google data. You can prevent the installation of cookies by setting your browser software accordingly; however, we point out that in this case you may not be able to fully use all functions of our website.

Google also offers a deactivation option for the most popular browsers, giving you more control over what data Google collects and processes. If you activate this option, website visit information will not be sent to Google Analytics. Activation does not prevent information from being transmitted to us or any other web analytics services we may use. For more information about Google’s opt-out option and to activate this option, please visit the following link: https://tools.google.com/­dlpage/gaoptout?hl=de

On our website, we use the component “Google Maps” of the company Google Inc., 1600 Amphitheater Parkway, Mountain View, CA 94043 USA, hereinafter “Google”.

Each time Google Maps is called up, Google sets a cookie to process user settings and data when viewing the page that has the Google Maps component integrated. This cookie is usually not deleted by closing the browser, but expires after a certain time, unless it is manually deleted by you.

If you disagree with the processing of your data, you may disable the “Google Maps” service and prevent the transmission of data to Google. To do this, you must disable the Java Script feature in your browser. Please be aware that in this case you will not be able to use “Google Maps” or may only do so to a limited extent.

Use of “Google Maps” and information obtained through “Google Maps” is subject to the Google Terms of Use

http://www.google.de/intl/de/­policies/terms/regional­.html

as well as the additional terms and conditions for “Google Maps”

https://www.google.com/intl/­de_de/help/terms_maps.html

Google Web Fonts 

This site uses so-called web fonts provided by Google for the uniform representation of fonts. When you call up a page, your browser loads the required web fonts into your browser cache to correctly display texts and fonts.

To do this, the browser you use must connect to Google’s servers. As a result, Google learns that our website has been accessed via your IP address. The use of Google Web Fonts is in the interest of a consistent and attractive presentation of our online services. This constitutes a legitimate interest within the meaning of Art. 6 (1) (f) GDPR.

If your browser does not support web fonts, a default font will be used by your computer.

For more information about Google Web Fonts, see developers.google.com/fonts/faq and Google’s privacy policy: https://www.google.com/policies/­privacy/.

Our website contains components of the provider facebook.com on. Facebook is a service of facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA. Each time you visit our website, which has such a component, this component causes the browser you are using to download a corresponding representation of the component from facebook. Through this process, facebook is informed about which specific page of our website is being visited by you. If you visit our page and you are logged in to facebook, facebook recognises, through the information collected by the component, which specific page you are visiting and assigns this information to your personal account on facebook. For example, if you click on the “Like” button or leave a comment, this information will be transmitted to your personal account on facebook and stored there. In addition, the information that you have visited our site will be transmitted to facebook. This happens regardless of whether you click the component or not. If you want to prevent this transmission and storage of data about you and your behaviour on our website through facebook, you must log out of facebook before you visit our site. The privacy policy provided by facebook provides more detailed information, in particular on the collection and use of the data by facebook, about your rights in this regard as well as the setting options for protecting your privacy: https://de-de.facebook.com/about/privacy/

An overview of the Facebook plugins can be found at  https://developers.facebook.com/­­docs/plugins/

On our website uses components (videos) of the company YouTube, LLC 901 Cherry Ave., 94066 San Bruno, CA, a company of Google Inc., Amphitheater Parkway, Mountain View, CA 94043, USA.

Here we use the “advanced privacy mode” option provided by YouTube.

When you visit a page that has an embedded video, it will connect to the YouTube servers and display the content on the website by notifying your browser.

According to information provided by YouTube, in the “extended privacy mode” data is only transmitted to the YouTube server, in particular which of our web pages you have visited, when watching the video. If you are logged in to YouTube at the same time, this information will be associated with your Membership Account on YouTube. You can prevent this by logging out of your member account before visiting our website.

Additional information about YouTube’s privacy policy is provided by Google at the following link:

https://www.google.de/intl/de/­policies/privacy/

Our website uses components of the supplier Vimeo. Vimeo is a service of Vimeo LCC, 555 West 18th Street, NY, New York 10011, USA. Each time you visit our website, which has such a component, this component causes the browser you are using to download a corresponding representation of the component from Vimeo. If you visit our page and you are logged in to Vimeo, Vimeo recognises, through the information collected by the component, which specific page you are visiting and assigns this information to your personal account on Vimeo. For example, if you click on the “Play” button or leave a comment, this information will be transmitted to your personal user account at Vimeo and stored there. In addition, the information that you have visited our site is passed on to Vimeo. This happens regardless of whether you click on the component / leave comments or not.

If you want to prevent this transmission and storage of data about you and your behaviour on our website through Vimeo, you must log out of Vimeo before you visit our site. The privacy notices of Vimeo provide more detailed information, in particular for the collection and use of data by Vimeo: https://vimeo.com/privacy

Since we use an external program component (MailChimp) to send our newsletters, you will be asked to give your consent to the use of your personal data in order to receive our newsletter as follows:

“I have read the privacy policy, in particular, I agree that the data processing may take place at a service provider in the US.”

We provide information about our offers in regular intervals with the newsletter. To receive our newsletter you need a valid email address. We will check the email address you entered to verify that you are the owner of the specified email address or the owner authorises reception of the newsletter. When you register for our newsletter, we will save your IP address and the date and time of your registration. In the event that a third party abuses your email address and registers for our newsletter without your knowledge, this serves as security on our part.

A comparison of the data collected with data which may be collected by other components of our site also does not occur.

We use the MailChimp component to send our newsletters. MailChimp is a service of The Rocket Science Group, LLC, 512 Means Street, Suite 404, Atlanta, GA 30318, USA.

Your data stored in the newsletter registration (email address, name if necessary, IP address, date and time of your registration) will be transferred to a server of The Rocket Science Group in the US and stored there under consideration of the “EU -US Privacy Shield”.

More information about privacy at MailChimp can be found at:

http://mailchimp.com/­legal/privacy/

Further information on the EU-US Privacy Shield can be found at:

Die Bundesbeauftragte für den ­Datenschutz und die ­Informationsfreiheit

http://ec.europa.eu/justice/­data-protection/international-transfers/­eu-us-privacy-shield/­index_en.htm

Subscribing to this newsletter and consenting to the storage of your data may be terminated or revoked at any time in the future. Details can be found in the confirmation email as well as in each individual newsletter.

Our newsletters contain so-called “web bugs”, which allow us to detect if and when an email was opened and which links in the email were followed by the personalised recipient.

This data is stored by us, so that we can optimally align our newsletter to the wishes and interests of our subscribers. Accordingly, the data thus collected is used to send personalised newsletters to the respective recipient.

We kindly ask you to give your consent in this regard as follows:

“I agree that my data and my usage behaviour will be electronically saved by newsletter tracking in order to send me an individualised newsletter. By revoking the consent to receive the newsletter, the consent to the aforementioned tracking will also be revoked.”

By revoking the consent to receive the newsletter, the consent to the aforementioned tracking will also be revoked.

Should you choose to pay with the online payment service provider as part of your order process PayPal, as part of the order so triggered, your contact information will be transmitted to PayPal. PayPal is an offer of PayPal (Europe) S.à.r.l. & Cie. SCA, 22-24 Boulevard Royal, L-2449 Luxembourg. PayPal assumes the role of an online payment service provider as well as a trustee and offers buyer protection services.

The personal data transmitted to PayPal is usually first name, last name, address, telephone number, IP address, email address, or other data required for order processing, as well as data related to the order such as number of articles, article number, invoice amount and tax percentages, billing information, etc.

This submission is necessary to process your order using the payment method you have selected, in particular to confirm your identity, to administer your payment and the customer relationship.

Please note, however: Personal data may be passed on by PayPal also to service providers, subcontractors or other affiliated companies, as far as this is required to fulfil the contractual obligations of your order or the personal data to be processed in the order.

Depending on the payment method selected via PayPal, e.g. invoice or direct debit, the personal data transmitted to PayPal will be transmitted by PayPal to credit bureaus. This submission is used for identity and credit checks related to the order you have placed. Please refer to PayPal’s privacy policy for details of which credit bureaus are used and what information PayPal collects, processes, stores and transmits  https://www.paypal.com/­de/webapps/mpp/ua­/privacy-full

We also use the Google Advertising Tool “Google Adwords” to promote our website. As part of this, we use the “Conversion Tracking” analytics service provided by Google Inc., 1600 Amphitheater Parkway, Mountain View, CA 94043 USA, “Google”, on our website. If you have reached our website via a Google ad, a cookie will be stored on your computer. Cookies are small text files that your Internet browser stores and saves on your computer. These so-called “conversion cookies” lose their validity after 30 days and are not used for your personal identification. If you visit certain pages on our website and the cookie has not expired yet, we and Google may recognise that you, as a user, clicked on one of our Google ads and were redirected to our site.

The information obtained through the “conversion cookies” is used by Google to create visitor statistics for our website. These statistics tell us the total number of users who clicked on our ad, and which pages on our site were subsequently viewed by their respective users. However, we and others who advertise via “Google Adwords” do not receive any information that personally identifies users.

You can prevent the installation of the “conversion cookies” by a corresponding setting of your browser, such as a browser setting that generally disables the automatic setting of cookies or specifically blocks only cookies from the domain “googleadservices.com”.

Google’s privacy policy can be found at the following link:
https://services.­google.com/­sitestats/de.html

We use on our website the Google Remarketing service of Google Inc., 1600 Amphitheater Parkway, Mountain View, CA 94043 USA, hereinafter “Google.” Google Remarketing will allow ads to appear to people who have already visited our website in the past. Within the Google ad network, advertisements tailored to their interests can be displayed on our site. Google Remarketing uses cookies for this evaluation. Cookies are small text files that are stored on your computer and allow an analysis of the use of the website. This will allow us to recognise our visitors as soon as they visit websites within Google’s advertising network. In this way, within the Google ad network, advertisements may be presented that relate to content that the visitor previously viewed on Google Network websites that also use Google’s remarketing feature. Google does not collect any personal data. You can disable this feature if you make the appropriate settings under http://www.google.com/­settings/ads

9. INFORMATION/REVOCATION/DELETION

On the basis of the Federal Data Protection Act, you can contact us free of charge with questions regarding the collection, processing or use of your personal data and the correction, blocking or deletion of the data or revocation of given consent. We point out that you have a right to correction of false data or deletion of personal data, should no statutory storage requirement preclude this. These rights result from the following legal regulations:

a) In accordance with Art. 15 GDPR, you may request information about your personal data processed by us. In particular, you may request information about the processing purposes, the category of personal data, the categories of recipients to whom your data has been disclosed, the planned retention period, the right of correction, deletion, limitation of processing or opposition, the existence of a right to complain, the source of their data, if not collected from us, and the existence of automated decision-making including profiling and, where appropriate, meaningful information about the details;

b) In accordance with Art. 16 GDPR, you can request the immediate correction of incorrect data or the completion of your personal data stored with us;

c) In accordance with Art. 17 GDPR, you may request the deletion of your personal data stored with us, unless the processing is required of the exercise of the right to freedom of expression and information, for the fulfilment of a legal obligation, for reasons of the public interest or for the assertion, exercise or defence of legal rights;

d) In accordance with Art. 18 GDPR, you can demand the restriction of the processing of your personal data, as far as the correctness of the data is disputed by you, the processing is unlawful, but you reject its deletion and we no longer need the data, but you have need it for asserting, exercising or defending legal claims or you have lodged an objection against the processing pursuant to Art. 21 GDPR;

e) In accordance with Art. 20 GDPR, you may request to receive your personal data provided to us in a structured, standard and machine-readable format or to request transmission to another controller;

f) In accordance with Art. 7 (3) GDPR, you may at any time revoke your once given consent to us. As a result, we are no longer allowed to continue the data processing based on this consent for the future, and

g) In accordance with Art. 77 GDPR, you can complain to a supervisory authority. As a rule, you can contact the supervisory authority of your usual place of residence or work or our place of business.

The responsible controller within the meaning of the GDPR is Action Sports Travel GmbH. You can reach our Data Protection Officer under datenschutz@action-sports-travel.de