Overview

This website does not measure you. It sets no cookies and uses no analytics, advertising or social-media components. We process personal data only when you contact us or ask us to arrange a journey.

This notice informs you, pursuant to Articles 13 and 14 of the General Data Protection Regulation (GDPR), about which data we process, for what purpose, and about your rights.

Controller

We are not required to appoint a data protection officer under Section 38 of the German Federal Data Protection Act (BDSG), as fewer than 20 persons are regularly engaged in the automated processing of personal data. For privacy matters please contact datenschutz@viaappia.de.

Visiting the website and server log files

When you visit this website, your browser transmits technically necessary data to our hosting provider’s server: IP address, date and time, page requested, referrer URL, browser type and operating system. These data are stored in server log files to deliver the site and to ensure the stability and security of the system.

The legal basis is Article 6 (1) (f) GDPR (legitimate interest in secure and functioning operation). Log files are deleted after {PH('7 / 14 days')} unless required to investigate a security incident.

This website is operated on a virtual server managed by us and provided by webgo GmbH, Wandsbeker Zollstraße 95, 22041 Hamburg, Germany, located in a data centre in Germany. A data processing agreement pursuant to Article 28 GDPR is in place with webgo GmbH. Server log files remain on our server and are not passed on to third parties.

Fonts and external content

The fonts used on this website (Bodoni Moda, Manrope) are stored locally on our server. No connection to Google or any other font provider is established. We do not embed maps, videos, fonts or scripts from third parties.

Contact and callback form

If you call us, send an e-mail or use the callback form, we process the data you provide (title, name, telephone number, e-mail address, preferred time for the callback, “private or corporate”, and your message) in order to answer your enquiry and prepare the conversation.

The legal basis is Article 6 (1) (b) GDPR (steps prior to entering into a contract) and Article 6 (1) (f) GDPR (legitimate interest in responding to enquiries). The form transmits your details encrypted (TLS) and exclusively to us; no third-party services are involved.

Enquiries that do not lead to an engagement are deleted after six months at the latest. If an engagement follows, the retention periods in the following section apply.

Arranging travel services

If you engage us to arrange a journey, we process the data required for that purpose: names of all travellers, dates of birth, address, contact details, identity card or passport data (where required for flights, entry or visas), frequent-flyer numbers, payment data, seat, meal and room preferences and, solely where you provide it, health data (e.g. mobility restrictions, allergies) under Article 9 (2) (a) GDPR.

The legal basis is Article 6 (1) (b) GDPR (performance of the agency contract) and Article 6 (1) (c) GDPR (retention obligations under commercial and tax law).

Recipients

To arrange your journey we transmit data to the service providers and tour operators involved: airlines, hotels, tour operators, car rental companies, cruise lines, transfer and destination partners, insurers, and booking and reservation systems (global distribution systems) through which flights and hotels are booked. These recipients process your data under their own responsibility.

Transfers to third countries

If your destination lies outside the European Union or the European Economic Area, transferring your data to service providers in that country is necessary for the performance of the journey (Article 49 (1) (b) and (c) GDPR). Such countries may not offer a level of data protection comparable to the EU. For flights to certain states (e.g. USA, Canada) airlines are legally required to transmit passenger data (API/PNR) to the authorities there.

Retention

Booking and accounting records are retained for ten years under Section 147 of the German Fiscal Code and Section 257 of the German Commercial Code. Other travel data are deleted no later than three years after the end of the journey, unless you wish us to keep your travel preferences for future journeys (Article 6 (1) (a) GDPR, revocable at any time).

Corporate travel and duty of care

For corporate travel we generally process travellers’ data on behalf of the sending company. Where we act on its instructions (e.g. expense statements, travel policies, whereabouts overviews as part of the employer’s duty of care), we conclude a data processing agreement with the company pursuant to Article 28 GDPR. Travellers receive the privacy information of their employer.

Your rights

With regard to your personal data you have the following rights against us:

• access (Article 15 GDPR)
• rectification (Article 16 GDPR)
• erasure (Article 17 GDPR)
• restriction of processing (Article 18 GDPR)
• data portability (Article 20 GDPR)
• objection to processing based on Article 6 (1) (f) GDPR (Article 21 GDPR)
• withdrawal of consent with effect for the future (Article 7 (3) GDPR)

An e-mail to datenschutz@viaappia.de is sufficient to exercise your rights. You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.

No automated decisions

We make no automated individual decisions and carry out no profiling (Article 22 GDPR). Every enquiry is handled personally.

Security and changes

This website is encrypted via TLS (recognisable by the padlock symbol and “https” in the address bar). We take technical and organisational measures under Article 32 GDPR to protect your data against loss, misuse and unauthorised access.

We adapt this privacy notice when the legal situation or our processing changes. The version published here applies.