1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Hannes Blaschke GmbH trading under the name Hannes Hawaii Tours Am Steinbruch 1 87545 Burgberg im Allgäu Germany Phone: +49 8323 9589 100 E-mail: info@hannes-hawaii-tours.de

Managing Director: Christoph Fürleger-Rädler Commercial Register: HRB 8399, Amtsgericht Kempten VAT ID: DE233362442

Contact for data protection matters: Christoph Fürleger-Rädler Am Steinbruch 1, 87545 Burgberg im Allgäu E-mail: datenschutz@hannes-hawaii-tours.de

​

2. General information on data processing

We process personal data of our users only to the extent necessary to provide a functioning website, our content and services, and to handle travel Bookings. Personal data is processed regularly only with the user's consent or where processing is permitted by law.

 

3. Hosting and provision of the website

3.1 Wix (website hosting)

Our website is hosted via the platform Wix.com Ltd., 40 Namal Tel Aviv St., Tel Aviv 6350671, Israel. Wix operates data centres in the USA and Ireland (EU). Israel, where Wix is headquartered, is recognised by the European Commission as a country with an adequate level of data protection (adequacy decision). For data transfers to the USA, Wix relies on the European Commission's Standard Contractual Clauses (SCCs).

When you visit our website, information is automatically stored in so-called server log files, which your browser transmits to us automatically. This includes: browser type and version, operating system used, referrer URL, hostname of the accessing device, time of the server request, and IP address.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the secure and efficient provision of our website). A data processing agreement (DPA) is in place.

Further information: Wix Privacy Policy

 

3.2 Mittwald (domain/DNS provider)

Our domain is managed via Mittwald CM Service GmbH & Co. KG, Königsberger Straße 4-6, 32339 Espelkamp, Germany. Mittwald processes exclusively technical DNS data. A DPA is in place.

3.3 Hetzner (Booking platform hosting)

Our Booking platform TourRise is hosted on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Hetzner operates data centres exclusively in Germany and Finland (EU). A DPA is in place.

​

3.4 IONOS (database hosting)

Our central customer database (MySQL) is hosted on servers of IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. Personal data of our customers is stored there as part of Booking processing and customer management (in particular name, contact details, Booking data). IONOS operates data centres in Germany (EU). A DPA is in place.

The legal basis is Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (legitimate interest in secure data storage).

 

4. Cookies and consent management

4.1 Cookiebot (cookie consent tool)

We use the Cookiebot service by Cybot A/S, Havnegade 39, 1058 Copenhagen, Denmark, to obtain and document your consent to the storage of certain cookies and to data processing. Cookiebot stores a cookie in your browser in order to be able to assign the consents you have given. This processing is carried out on the basis of Art. 6(1)(c) GDPR (legal obligation).

Further information: Cookiebot Privacy Policy

 

4.2 Technically necessary cookies

We use technically necessary cookies to make our website function properly. These cookies are set on the basis of Art. 6(1)(f) GDPR.

 

4.3 Analytics and marketing cookies

Analytics and marketing cookies are only set with your explicit consent in accordance with Art. 6(1)(a) GDPR. Details on the cookies used can be found in the following sections and in our Cookiebot banner.

 

5. Web analytics and marketing

5.1 Google Analytics 4 (GA4)

We use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies that enable analysis of your use of the website. The information generated by the cookie about your use of this website is generally transferred to a Google server in the EU and stored there. In exceptional cases, a transfer to servers of Google LLC in the USA may occur; Google LLC is certified under the EU-U.S. Data Privacy Framework.

We only use Google Analytics with your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time via the Cookiebot banner.

Further information: Google Privacy Policy

 

5.2 Wix Analytics

Wix provides integrated analytics functions that supply us with aggregated usage data about our website. This processing is carried out on the basis of Art. 6(1)(f) GDPR.

 

5.3 Google Ads (conversion tracking)

We use conversion tracking from Google Ads. When you reach our website via a Google ad, a cookie is placed on your device. This cookie is used to measure the success of our advertisements. Personal data (in particular IP address, cookie identifiers, pages visited) may be transmitted to Google in the process. Google LLC is certified under the EU-U.S. Data Privacy Framework.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR.

 

5.4 Facebook Pixel (Meta)

We use the Facebook Pixel provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. This tool enables us to measure the effectiveness of our Facebook advertisements and to create target audiences for ads.

When you visit our website, the Facebook Pixel establishes a direct connection to Meta's servers. A transfer of data to the USA may occur; Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. For the collection and transfer of data, joint controllership exists with Meta pursuant to Art. 26 GDPR (Controller Addendum). Further processing by Meta is carried out under Meta's sole responsibility. You can withdraw your consent at any time via the Cookiebot banner.

Further information: Meta Privacy Policy

 

6. Booking and payment processing

6.1 TourRise (Booking platform)

For the processing of travel Bookings, we use the Booking platform TourRise, hosted on servers of Hetzner Online GmbH in Germany (see section 3.3). When making a Booking, the following personal data is collected: name, address, date of birth, e-mail address, phone number, and Booking-specific details.

Processing is carried out for the performance of the travel contract pursuant to Art. 6(1)(b) GDPR. No customer account is created; Bookings are made as guest Bookings.

 

6.2 Stripe (payment processing)

For payment processing, we use the service of Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin 2, Ireland. The following payment methods are available: SEPA direct debit, PayPal and, for customers outside the DACH region, SEPA bank transfer.

Your payment data is transmitted directly to Stripe and processed there. Payment data is not fed back to our systems and remains exclusively with Stripe. Stripe also processes data for its own purposes (e.g. fraud prevention, compliance with statutory financial requirements) as an independent controller.

The legal basis is Art. 6(1)(b) GDPR (performance of a contract). A DPA with Stripe is in place.

Further information: Stripe Privacy Policy

 

7. Customer management and communication

7.1 Zoho One (CRM, Desk, Campaigns, Forms, Survey, etc.)

We use the Zoho One Suite by Zoho Corporation B.V., Beneluxlaan 4B, 3527 HT Utrecht, Netherlands, for managing customer relationships and communicating with our customers. Zoho stores data in data centres within the EU (EU Data Centre). A DPA is in place.

We use the following modules in particular:

Zoho CRM: Management of customer data (name, contact details, Booking history) and sending e-mails to customers. The legal basis is Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (legitimate interest in efficient customer management).

Zoho Desk: Handling customer enquiries and support tickets, including e-mail replies to customers. The legal basis is Art. 6(1)(b) GDPR.

Zoho Campaigns: Sending Newsletters and marketing e-mails. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. You can unsubscribe from the Newsletter at any time (unsubscribe link in every e-mail).

Zoho Forms: Provision of online forms through which customer data is collected. The legal basis is Art. 6(1)(a) or (b) GDPR depending on the form.

Zoho Survey: Conducting customer surveys. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR.

Zoho Analytics, Zoho Workflow and further modules are used for internal evaluations and process automation.

Further information: Zoho Privacy Policy

 

7.2 Google Workspace

We use Google Workspace (Google Ireland Limited) for internal collaboration, including Google Drive (document storage), Google Sheets (spreadsheets) and Google Calendar. Personal customer data may be processed within these services.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in efficient internal collaboration). Google LLC is certified under the EU-U.S. Data Privacy Framework. A DPA is in place.

 

7.3 Gmail

Business e-mail communication is handled via Google Workspace with our own domain. E-mails to customers are, however, sent primarily via Zoho (CRM, Desk, Campaigns).

 

8. Automation and data processing

8.1 Make.com (formerly Integromat)

We use Make.com by Celonis SE, Thomas-Dehler-Straße 27, 81737 Munich, Germany, to automate business processes. In doing so, personal customer data is transferred between our systems, in particular:

• Forwarding Booking data to Zoho CRM

• Processing e-mails and documents via Docparser

• Synchronising data with Google Sheets and Google Drive

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in efficient data processing). A DPA is in place.

Further information: Make Privacy Policy

 

8.2 Docparser

We use Docparser for the automated processing of documents (Booking confirmations, invoices) that may contain personal data. Docparser operates its services in the Amazon Web Services (AWS) cloud; to the best of our knowledge, the servers are located in the USA. Docparser relies on the European Commission's Standard Contractual Clauses (SCCs) as the legal basis for data transfers. The extracted data is transferred to our systems via Make.com.

The legal basis is Art. 6(1)(f) GDPR. A DPA is in place.

Further information: Docparser Privacy Policy

 

9. Disclosure of data to third parties

9.1 Service providers involved in travel delivery

In order to fulfil the travel contract, it is necessary for us to pass on personal data (in particular name, date of birth, contact details and Booking-relevant information) to the service providers involved in the trip. These include in particular the following categories of recipients:

• Accommodation providers (hotels, apartment complexes, other accommodation) at the respective destination

• Airlines, to whom passenger data is transmitted as part of the flight Booking

• Transfer service providers who handle transport between the airport and accommodation or other locations

• Car hire and bike rental providers, where these services form part of the trip

Service providers process the data as independent controllers within the meaning of the GDPR and are subject to their respective national data protection regulations. A transfer to service providers in third countries (e.g. the USA in the case of Hawaii trips) is strictly necessary for the performance of the travel contract. This is carried out on the basis of Art. 49(1)(b) GDPR, as the transfer is necessary for the performance of the contract concluded between you and us.

The legal basis is Art. 6(1)(b) GDPR (performance of the travel contract).

 

9.2 Flight Booking systems and airlines

For flight Bookings, we use the global distribution systems (GDS) Amadeus and IRIS, as well as the Booking platform AER. The passenger data required for flight Bookings (name, date of birth, passport data where required, contact details) is transmitted to the respective system and the booked airline. We also have a direct connection to Condor Flugdienst GmbH, through which passenger data is transmitted directly.

For the technical connection to airlines, we also use the HitchHiker service (NDC API), which acts as an interface between our systems and the airlines.

The legal basis is Art. 6(1)(b) GDPR (performance of a contract).

 

9.3 Transfer service providers

For the organisation of airport transfers in Mallorca and Fuerteventura, we work with the transfer service provider DTS (based in Spain). The personal data required to carry out the transfer (name, flight arrival details, accommodation) is transmitted to DTS. DTS processes the data as an independent controller. The data transfer takes place within the EU.

The legal basis is Art. 6(1)(b) GDPR (performance of a contract).

 

9.4 Retool (hotel partner communication)

To process your travel Booking, we pass on required personal data (in particular name and Booking-relevant information) to our hotel partners via a frontend we have created. For this purpose, we use Retool, Inc., 1550 Bryant St., Suite 950, San Francisco, CA 94103, USA, as the platform.

The transfer of data to hotel partners is necessary for the performance of the travel contract (Art. 6(1)(b) GDPR). Retool Inc. is certified under the EU-U.S. Data Privacy Framework. A DPA is in place.

Further information: Retool Privacy Policy

 

10. Embedded content and external services

10.1 YouTube

Our website embeds videos from the YouTube platform provided by Google Ireland Limited. When a page with an embedded YouTube video is loaded, a connection to YouTube's servers is established and certain data is transmitted (including IP address, page accessed). If you are simultaneously logged into your YouTube/Google account, YouTube may be able to associate the page visit with your profile. Google LLC is certified under the EU-U.S. Data Privacy Framework.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR.

Further information: Google Privacy Policy

 

10.2 Google Maps

We embed Google Maps provided by Google Ireland Limited on our website. When the map loads, data (including IP address) is transmitted to Google.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR.

 

11. Newsletter

We send Newsletters via Zoho Campaigns (see section 7.1). You can sign up for the Newsletter via a registration form on our website. We use the double opt-in procedure: after signing up, you will receive an e-mail with a confirmation link.

As part of Newsletter dispatch, we store your e-mail address as well as the time of registration and confirmation. Zoho Campaigns also collects statistical data (open rates, click behaviour).

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. You can withdraw your consent at any time by using the unsubscribe link in every Newsletter e-mail.

 

12. Contact

If you contact us via the contact form, e-mail or phone, the data you provide (name, e-mail address, message) will be stored for the purpose of processing your enquiry.

The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries).

 

13. SSL/TLS encryption

For security reasons and to protect the transmission of personal data, our website uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the address bar of the browser changes from "http://" to "https://" and by the padlock symbol in your browser bar.

When SSL or TLS encryption is active, the data you transmit to us cannot be read by third parties.

 

14. Data transfers to third countries

Some of the service providers we use are based in or operate servers outside the European Economic Area (EEA), in particular in the USA. The following safeguards apply to these transfers:

• EU-U.S. Data Privacy Framework: Google LLC, Meta Platforms Inc., Stripe Inc. and Retool Inc. are certified under the EU-U.S. Data Privacy Framework, which ensures an adequate level of data protection (adequacy decision of the European Commission of 10 July 2023).

• Standard Contractual Clauses: With service providers not covered by the Data Privacy Framework (e.g. Wix, Docparser), we have concluded Standard Contractual Clauses with the European Commission. Wix's registered office in Israel is also subject to an adequacy decision by the European Commission.

• EU data centres: Zoho, Hetzner, IONOS and Mittwald process data exclusively in data centres within the EU/EEA.

 

15. Retention periods

We store personal data only for as long as is necessary for the respective processing purpose or as required by statutory retention obligations. In particular:

• Booking data: Up to 10 years after completion of the trip (statutory retention periods under commercial and tax law pursuant to §§ 147 AO, 257 HGB).

• Newsletter data: Until you withdraw your consent.

• Web analytics data: In accordance with the settings in Google Analytics (14 months by default).

• Contact enquiries: After final processing and expiry of any warranty periods.

 

16. Your rights

You have the following rights with regard to your personal data:

• Right of access (Art. 15 GDPR)

• Right to rectification (Art. 16 GDPR)

• Right to erasure (Art. 17 GDPR)

• Right to restriction of processing (Art. 18 GDPR)

• Right to data portability (Art. 20 GDPR)

• Right to object (Art. 21 GDPR)

• Right to withdraw consent given (Art. 7(3) GDPR)

To exercise your rights, please contact the controller or the data protection officer named above.

Special note on the right to object to direct marketing (Art. 21(2) GDPR)

Where we process your personal data for the purposes of direct marketing, you have the right to object to such processing at any time. If you object to processing for direct marketing purposes, your personal data will no longer be processed for those purposes. The objection can be made informally and should be addressed to the controller named above.

You also have the right to lodge a complaint with a data protection supervisory authority. The supervisory authority responsible for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) Promenade 18, 91522 Ansbach Website: www.lda.bayern.de