Data protection

Person responsible for data processing

HCT Hamburg Citytours GmbH is responsible for the processing of personal data in accordance with the General Data Protection Regulation (GDPR) and other relevant data protection laws. The contact details are as follows: Address: Hammerbrookstraße 94, D-20097 Hamburg. Telephone number: (+49) 800 77 88 970. e-mail address: info@hamburg-citytours.de. The company website is available at https://www.hamburg-citytours.de .

General data processing

HCT Hamburg Citytours GmbH undertakes to process users' personal data only to the extent necessary to provide a functional website and to provide our services. As a rule, such data is processed on the basis of the user's consent. Exceptions exist in cases where prior consent cannot be obtained for practical reasons and the data processing is justified by legal provisions.

The legal basis for data processing is defined as follows:

If the processing of personal data is based on the consent of the data subject, Article 6(1) sentence 1(a) of the GDPR serves as the legal basis.

The legal basis for the processing of data necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract is Article 6(1) sentence 1 point (b) GDPR.

If processing is necessary to fulfill a legal obligation to which our company is subject, this is based on Article 6 (1) sentence 1 letter c of the GDPR.

If vital interests of the data subject or another natural person require the processing of personal data, Article 6(1) sentence 1 letter of the GDPR serves as the legal basis.

If processing is necessary for the purposes of the legitimate interests pursued by our company or by a third party and the interests, fundamental rights and freedoms of the data subject do not override the first-mentioned interest, the legal basis for processing is Article 6 (1) sentence 1 letter of the GDPR.

With regard to the deletion and storage duration of data, personal data of the data subject will be deleted or blocked as soon as the purpose of storage no longer applies. Data may be stored for longer if this has been provided for by the European or national legislator in EU regulations, laws or other provisions to which the controller is subject. The data will also be blocked or deleted if a storage period prescribed by the aforementioned standards expires, unless there is a need for further storage of the data for the conclusion or fulfillment of a contract.

Rights of the data subject

Persons whose personal data is processed have various rights vis-à-vis the controller in accordance with the General Data Protection Regulation (GDPR). These rights include:

Right to information: You can request confirmation from the controller as to whether your personal data is being processed. If this is the case, you have the right to obtain information about the processing purposes, the categories of personal data, the recipients of the data, the planned storage period, the existence of rights to rectification, erasure, restriction of processing or objection, the right to lodge a complaint with a supervisory authority, the origin of the data and the existence of automated decision-making, including profiling.

Right to rectification: You have the right to request the rectification of inaccurate personal data or the completion of your personal data without undue delay.

Right to restriction of processing: Under certain circumstances, you may request the restriction of the processing of your personal data.

Right to erasure: You can request the immediate erasure of your personal data if one of the legally defined reasons applies and the processing is not necessary.

Right to information: If you have asserted the right to rectification, erasure or restriction of processing against the controller, the controller is obliged to notify all recipients to whom the personal data have been disclosed of this rectification or erasure of the data or restriction of processing.

Right to data portability: You have the right to receive your personal data, which you have provided to the controller, in a structured, commonly used and machine-readable format and to transmit those data to another controller without hindrance.

Right to object: You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you.

Right to revoke the declaration of consent under data protection law: You have the right to revoke your declaration of consent under data protection law at any time.

Automated individual decision-making, including profiling: You have the right not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you.

Right to lodge a complaint with a supervisory authority: You have the right to lodge a complaint with a supervisory authority about the processing of your personal data.

Provision of the website and creation of log files

Description and scope of data processing: Every time you visit our website, our system automatically collects data and information from the computer system of the accessing computer. The data collected includes

Information about the browser type and version used,

The user's operating system,

The user's Internet service provider,

The IP address of the user,

Date and time of access,

Websites from which the user's system accesses our website,

Websites that are accessed by the user's system via our website.

This data is stored in the log files of our system. This data is not stored together with other personal data of the user.

Purpose of data processing: The temporary storage of the IP address by the system is necessary to enable the website to be delivered to the user's computer. For this purpose, the user's IP address must remain stored for the duration of the session. The data is stored in log files to ensure the functionality of the website. We also use the data to optimize the website and to ensure the security of our information technology systems. The data is not analyzed for marketing purposes in this context.

Legal basis for data processing: The legal basis for the temporary storage of data and log files is Art. 6 para. 1 sentence 1 lit. f GDPR.

Duration of storage: The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. In the case of the collection of data for the provision of the website, this is the case when the respective session has ended. If the data is stored in log files, this is the case after seven days at the latest. Storage beyond this period is possible. In this case, the IP addresses of the users are deleted or anonymized so that it is no longer possible to identify the accessing client.

Objection and removal option: The collection of data for the provision of the website and the storage of data in log files is absolutely necessary for the operation of the website. Consequently, there is no possibility for the user to object.

Use of cookies

Description and scope of data processing: Our website uses cookies. Cookies are text files that are stored in the Internet browser or by the Internet browser on the user's computer system. When a user accesses our website, a cookie may be stored on the user's operating system. This cookie contains a characteristic string of characters that enables the browser to be uniquely identified when the website is called up again. We use cookies to make our website more user-friendly. Some elements of our website require that the accessing browser can be identified even after a page change. The following data is stored and transmitted in the cookies:

Language settings,

Log-in information.

In addition, we use cookies on our website that enable an analysis of the user's surfing behavior. The following data can be transmitted in this way:

Search terms entered,

Frequency of page views,

Use of website functions.

The user data collected in this way is pseudonymized by technical precautions. It is therefore no longer possible to assign the data to the accessing user. The data is not stored together with other personal data of the user.

Purpose of data processing: The purpose of using technically necessary cookies is to simplify the use of websites for users. Some functions of our website cannot be offered without the use of cookies. For these, it is necessary for the browser to be recognized even after a page change. The user data collected by technically necessary cookies is not used to create user profiles. Analysis cookies are used for the purpose of improving the quality of our website and its content. Through the analysis cookies, we learn how the website is used and can thus constantly optimize our offer.

Legal basis for data processing: The legal basis for the processing of personal data using technically necessary cookies is Art. 6 para. 1 sentence 1 lit. f GDPR. The legal basis for the processing of personal data using cookies for analysis purposes is Art. 6 para. 1 sentence 1 lit. a GDPR if the user has given their consent.

Duration of storage, objection and removal options: Cookies are stored on the user's computer and transmitted by it to our website. Users therefore also have full control over the use of cookies. Users can deactivate or restrict the transmission of cookies by changing the settings in their Internet browser. Cookies that have already been saved can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to use all functions of the website to their full extent.

E-mail contact

Description and scope of data processing: It is possible to contact our company via the e-mail address provided. If a user uses this method, the user's personal data transmitted with the e-mail will be stored. This includes the information contained in the e-mail and the e-mail address. The data will not be passed on to third parties in this context. The data is used exclusively for processing the conversation.

Purpose of data processing: We process the personal data from the email solely for the purpose of processing the contact. The processing of personal data enables us to process the communication.

Legal basis for data processing: The legal basis for the processing of data transmitted in the course of sending an email is Art. 6 para. 1 lit. f GDPR. If the e-mail contact is aimed at the conclusion of a contract, Art. 6 para. 1 lit. b GDPR must also be used as the legal basis.

Duration of storage: The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. For personal data sent by email, this is the case when the respective conversation with the user has ended. The conversation is ended when it can be inferred from the circumstances that the matter in question has been conclusively clarified.

Possibility of objection and removal: The user has the possibility to revoke his consent to the processing of personal data at any time. If the user contacts us by email, they can object to the storage of their personal data at any time. In such a case, the conversation cannot be continued. All personal data stored in the course of contacting us will be deleted in this case.

Contact form

Description and scope of data processing: There is a contact form on our website that can be used to contact us electronically. If a user makes use of this option, the data entered in the input mask will be transmitted to us and stored. This data includes

E-mail address,

Name,

First name,

Address,

Telephone/mobile number,

IP address of the calling computer,

Date and time of contact,

Company name (if specified).

At the time the message is sent, the user's IP address and the date and time of contact are also recorded. The user's consent is obtained for the processing of the data as part of the sending process and reference is made to this privacy policy.

As an alternative to using the contact form, it is possible to contact us via the e-mail address provided. In this case, the user's personal data transmitted with the e-mail will be stored.

This personal data will not be passed on to third parties. The data is used exclusively for processing the conversation.

Purpose of data processing: The processing of the personal data from the input mask serves us solely to process the contact. In the case of contact by email, this also constitutes the necessary legitimate interest in processing the data. The personal data processed during the sending process serves the purpose of preventing misuse of the contact form and ensuring the security of our information technology systems.

Legal basis for data processing: The legal basis for the processing of data is Art. 6 para. 1 sentence 1 lit. a GDPR if the user has given consent. If the contact is aimed at the conclusion of a contract, Art. 6 para. 1 sentence 1 lit. b GDPR must also be used as the legal basis.

Duration of storage: The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. For the personal data from the input screen of the contact form and those sent by email, this is the case when the respective conversation with the user has ended. The conversation is ended when it can be inferred from the circumstances that the matter in question has been conclusively clarified. The additional personal data collected during the sending process will be deleted after a period of seven days at the latest.

Company presence in social networks

Use of company presences in social networks: We maintain company presences on various social networks. If you interact with our corporate presence (e.g. commenting, posting, liking, etc.), personal data may be made public. This may include your real name, your profile picture and the action you have taken. We only have limited influence on the processing of your personal data by the social networks. In any case, we are jointly responsible for the data processing there and offer you information about our social network presences.

Instagram: We use the Instagram service, part of Facebook Ireland Ltd, 4 Grand Canal Square, Dublin, Ireland. We offer information and communication options on our Instagram page. Data processing is carried out on the basis of suitable guarantees in accordance with Art. 46 et seq. GDPR, in particular standard data protection clauses pursuant to Art. 46 para. 2 c) GDPR. Further information can be found at: https://help.instagram.com/519522125107875.

Legal basis: The legal basis for the processing of data in the context of our corporate presence on social networks is Art. 6 para. 1 sentence 1 lit. a GDPR. We do not store the data generated by the corporate presence in our own systems.

Right of objection and removal: You have the right to object to the processing of your personal data collected in the course of using our company website and to assert your rights as a data subject in accordance with Section IV of this Privacy Policy. An email to info@hamburg-citytours.de is sufficient for an informal notification. Further information on the processing of your data by the social networks and corresponding objection options can be found in the respective privacy policies of the providers.

Hosting

The HCT Hamburg Citytours GmbH website is hosted on the servers of an external service provider. This service provider is responsible for the technical infrastructure of our website and the associated data processing.

Data collected: As part of the hosting process, certain data is automatically collected that your browser transmits to the server. This data includes

Browser type and browser version,

Operating system used,

Referrer URL (the previously visited page),

Host name of the accessing computer (IP address),

Date and time of the server request.

This information is technically necessary in order to deliver the content of our website correctly and is mandatory when using the Internet.

Purpose of data processing: The storage of this data in so-called server log files is necessary to display the website and to ensure its stability and security.

Legal basis: The processing of this data is based on our legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR to ensure a technically error-free presentation and optimization of our website.

Storage period: The data is stored for the period required to achieve the storage purpose and then routinely deleted, provided there are no further retention obligations or legitimate interests for further storage.

Data security: To protect the security of your data during transmission, we use state-of-the-art encryption methods (e.g. SSL) via HTTPS.

The use of hosting services is an essential part of our online offering and serves to provide a secure, fast and efficient online presence through a professional provider.

HCT Hamburg Citytours GmbH
Hammerbrookstraße 94
20097 Hamburg
Register court: Hamburg Local Court
Register number: HRB 104449