Privacy policy

Table of contents

1. General information
   1. Objective and responsibility
   2. Legal basis
   3. Rights of data subjects
   4. Data deletion and storage period
   5. Security of processing
   6. Data transfer to third parties, subcontractors and third-party providers
2. Specific data processing
   1. Collection of information on the use of the online offering
   2. Contact form and contact by e-mail
   3. Tag Manager
   4. Google Analytics
   5. Consent management
   6. Google Fonts
   7. Links to other websites
3. Cookie-Policy
   1. General information
   2. Options for objection
   3. Cookie overview
4. Changes to the privacy policy

1. General information

   1. Objective and responsibility
      1. This privacy policy informs you about the nature, scope and purpose of the processing of personal data in relation to our online offering and the associated websites, functions and content (hereinafter collectively referred to as "online offering" or "website").
      2. The provider of the online offering and the entity responsible for data protection is Deutscher Travel Retail Verband e.V. (Koreastraße 3, 20457 Hamburg) – hereinafter referred to as the "provider", "we" or "us".
      3. Our online offering is provided by STRATO AG (Otto-Ostrowski-Straße 7, 10249 Berlin). The server location is Germany.
      4. The term "user" refers to all customers and visitors to the online offering.
   2. Legal basis

      We collect and process personal data based on the following legal basis:

      1. Consent in accordance with Article 6(1)(a) of the General Data Protection Regulation (GDPR). Consent is any voluntary expression of will for a specific case, given in an informed and unambiguous manner in the form of a statement or other clear affirmative action, by which the data subject indicates that they agree to the processing of personal data relating to them.
      2. Necessity for the performance of a contract or in order to take steps prior to entering into a contract pursuant to Article 6(1)(b) GDPR, i.e. the data is necessary for us to fulfil our contractual obligations towards you or we need the data to prepare for the conclusion of a contract with you.
      3. Processing to fulfil a legal obligation pursuant to Article 6(1)(c) GDPR, i.e. processing of the data is required, for example, by law or other regulations.
      4. Processing to safeguard legitimate interests pursuant to Article 6(1)(f) GDPR, i.e. processing is necessary to safeguard our legitimate interests or those of third parties, unless your interests or fundamental rights and freedoms requiring the protection of personal data prevail.
   3. Rights of data subjects

      You have the following rights with regard to our processing of your data:

      1. Right to lodge a complaint with a supervisory authority pursuant to Article 13(2)(d) GDPR and Article 14(2)(e) GDPR.
      2. Right of access pursuant to Article 15 GDPR
      3. Right to rectification pursuant to Article 16 GDPR
      4. Right to erasure ("right to be forgotten") pursuant to Article 17 GDPR
      5. Right to restriction of processing pursuant to Article 18 GDPR
      6. Right to data portability pursuant to Article 20 GDPR
      7. Right to object pursuant to Article 21 GDPR

      Note: Users may object to the processing of their personal data at any time with effect for the future in accordance with the statutory provisions. In particular, the objection may be lodged against processing for direct marketing purposes.

      Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR.

   4. Data deletion and storage period

      The personal data of the data subject will be deleted or blocked as soon as the purpose of storage no longer applies. Storage may also take place if this has been provided for by European or national legislators in EU regulations, laws or other provisions to which the controller is subject. The data will also be blocked or deleted if a storage period prescribed by the aforementioned standards expires, unless there is a need for further storage of the data for the conclusion or fulfilment of a contract.

   5. Security of processing
      1. We have implemented appropriate, state-of-the-art technical and organisational security measures (TOMs). This protects the data we process from accidental or intentional manipulation, loss, destruction and unauthorised access.
      2. These security measures include, in particular, the encrypted transmission of data between your browser and our server.
   6. Data transfer to third parties, subcontractors and third-party providers
      1. Personal data is only transferred to third parties within the framework of legal requirements. We only pass on user data to third parties if this is necessary, for example, for billing purposes or for other purposes if the transfer is necessary to fulfil contractual obligations towards users.
      2. If we use subcontractors for our online services, we have taken appropriate contractual precautions and technical and organisational measures with regard to these companies.
      3. If we use content, tools or other resources from other companies (hereinafter collectively referred to as "third-party providers") whose registered office is located in a third country, it can be assumed that data will be transferred to the countries where the third-party providers are based. We only transfer personal data to third countries if an adequate level of data protection is in place, if we have the consent of the users or if we have other legal permission to do so.

2. Specific data processing

   1. Collection of information on the use of the online service
      1. When using the online offer, information is automatically transmitted to us by the user's browser; this includes the name of the website accessed, file, date and time of access, amount of data transferred, notification of successful access, browser type and version, the user's operating system, referrer URL (the previously visited page), IP address and the requesting provider.
      2. This information is processed on the basis of legitimate interests pursuant to Article 6(1)(f) GDPR (e.g. optimisation of the online offering) and to ensure the security of processing pursuant to Article 5(1)(f) GDPR (e.g. to defend against and investigate cyber attacks).
      3. The information is automatically deleted 4 weeks after the end of the connection – i.e. use of the online offering – unless other retention periods prevent this.
      4. The collection and storage of data in log files is essential for the provision of the online offering. Therefore, the user has no option to delete, object to or correct the data.
   2. Contact form and contact via email
      1. When contacting us via email, the data provided by the user will be processed exclusively for the purpose of handling the enquiry and its processing.
      2. Any other use of the data will only take place on the basis of the user's consent.
   3. Tag Manager
      1. We use Google Tag Manager on our website. Google Tag Manager is a service provided by Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.
      2. Google Tag Manager allows us to integrate various codes and services into our website in an orderly and simplified manner. Google Tag Manager implements the tags or "triggers" the integrated tags. When a tag is triggered, Google may process information (including personal data) and process it. It cannot be ruled out that Google may also transfer the information to a server in a third country.
      3. In particular, the following personal data is processed by Google Tag Manager:
         • Online identifiers (including cookie identifiers)
         • IP address
      4. You can find more detailed information about Google Tag Manager on the websites https://marketingplatform.google.com/about/analytics/tag-manager/use-policy/ and https://www.google.com/intl/de/policies/privacy/index.html (section "Data we receive based on your use of our services").
      5. Furthermore, we have concluded a contract with Google for the use of Google Tag Manager (Art. 28 GDPR). Google processes the data on our behalf in order to trigger the stored tags and display the services on our website. Google may transfer this information to third parties if required by law or if third parties process this data on behalf of Google.
      6. If you have deactivated individual tracking services (e.g. by setting an opt-out cookie), the deactivation remains in place for all affected tracking tags that are integrated via Google Tag Manager.
      7. By integrating Google Tag Manager, we aim to simplify and clarify the integration of various services. In addition, the integration of Google Tag Manager optimises the loading times of the various services.
      8. The legal basis for the processing of personal data described here within the scope of the measurement process is your express consent in accordance with Art. 6 (1) (a) GDPR.
      9. The legal basis for the processing of data processed in the context of obtaining consent is our legitimate interest pursuant to Art. 6(1)(f) GDPR. We have a legitimate interest in being able to prove your consent to the measurement process (Art. 7(1) GDPR).
   4. Google Analytics
      1. Based on your consent, we use Google Analytics, a web analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) – hereinafter referred to as "Google" – for the analysis, optimisation and economic operation of our online offering in accordance with Art. 6 (1) (a) GDPR. Google uses cookies and other technologies. The information generated by the service about the use of the online offering by users is transmitted to a Google server in the USA and processed there.
      2. Google acts on our behalf within the framework of order processing in accordance with Article 28 GDPR. We have concluded a data protection agreement with Google that contains the EU standard data protection clauses.
      3. In addition, we have concluded a joint responsibility agreement with Google in accordance with Article 26 GDPR for the use of Google's measurement services (see https://support.google.com/analytics/answer/9012600). Within this framework, we have agreed with Google to be responsible for fulfilling the information obligations and for ensuring the rights of data subjects in accordance with Chapter 3 of the GDPR, as well as for the security of processing and reporting and notification obligations. (Articles 32 to 34 GDPR). Google will use the information to evaluate the use of our online offering by users, to compile reports on the activities within this online offering and to provide us with further services associated with the use of this online offering and the Internet. In doing so, pseudonymous user profiles of users can be created from the processed data.
      4. We use Google Analytics to display advertisements placed within Google's advertising services and those of its partners only to users who have shown an interest in our online offering or who have certain characteristics (e.g. interest in certain topics or products, determined on the basis of the websites visited) that we transmit to Google (so-called ‘remarketing audiences’ or ‘Google Analytics audiences’). With the help of remarketing audiences, we also want to ensure that our ads correspond to the potential interests of users and do not appear intrusive.
      5. We use Google Analytics with IP anonymisation enabled.
      6. Google Analytics stores cookies in your web browser for a period of two years from your last visit. These cookies contain a randomly generated user ID that can be used to recognise you on future visits to the website. Users can prevent cookies from being stored by adjusting their browser software settings accordingly; users can also prevent Google from collecting the data generated by the cookie and relating to their use of the online service, as well as Google from processing this data, by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=de.
      7. The recorded data is stored together with the randomly generated user ID, which enables the evaluation of pseudonymous user profiles. This user-related data is automatically deleted after 14 months. Other data remains stored in aggregated form for an indefinite period.
      8. Further information on data use by Google, settings and revocation options can be found on Google's websites:
         - https://policies.google.com/technologies/partner-sites?hl=de
         ("Data use by Google when you use our partners' websites or apps")
         - https://policies.google.com/technologies/ads
         ("Data use for advertising purposes")
         - https://adssettings.google.com/authenticated
         ("Manage information that Google uses to show you ads").
   5. Consent management
      1. This website uses Cookiebot's cookie consent technology to obtain your consent to store certain cookies on your device and to document this in accordance with data protection regulations. This technology is provided by Cybot A/S (Havnegade 39, 1058 Copenhagen, Denmark, website: https://www.cookiebot.com/) – hereinafter referred to as "Cookiebot".
      2. When you visit our website, the following personal data is transferred to Cookiebot:
         • Your consent(s) or withdrawal of your consent(s)
         • Your IP address
         • Information about your browser
         • Information about your device
         • The time of your visit to the website
      3. Furthermore, Cookiebot stores a cookie in your browser in order to be able to assign the consents you have given or their revocation. The data collected in this way is stored until you request us to delete it, delete the Cookiebot cookie yourself or the purpose for data storage no longer applies. Mandatory legal retention obligations remain unaffected.
      4. Cookiebot is used to obtain the legally required consent for the use of cookies. The legal basis for this is Art. 6 (1) (c) GDPR.
   6. Google Fonts
      1. To make visiting our website more attractive, we use fonts from Google (Google Inc., 1600 Amphitheatre Parkway Mountain View, CA 94043, USA), known as Google Fonts.
      2. We have integrated Google Fonts locally, i.e. on our web server. This means that there is no connection to Google servers and therefore no transfer of your data to Google.
   7. Links to other websites
      1. When using some of our services, you will be automatically redirected to other websites.
      2. Please note that this privacy policy does not apply there. The privacy policy of the linked website may differ significantly from this one.

3. Cookie Policy

   1. General Information
      1. Cookies are pieces of information that are transferred from our web server or third-party web servers to users' web browsers and stored there for later retrieval. Cookies can be small files or other types of information storage.
      2. If users do not want cookies to be stored on their computer, they are asked to deactivate the corresponding option in their browser's system settings. Stored cookies can be deleted in the browser's system settings. Excluding cookies may lead to functional restrictions of this online offer.
   2. Options for objection

      Once you have given your consent, you can object to the use of cookies at any time via this link

   3. Cookie overview

      Name: _gid
      Domain: dtrv.org
      Provider: Google
      Purpose: Registers a unique ID that is used to generate statistical data on how the visitor uses the website.
      Duration: 1 day

      Name: _ga
      Domain: dtrv.org
      Provider: Google
      Purpose: Registers a unique ID that is used to generate statistical data on how visitors use the website.
      Duration: 1 month

      Name: _gat_#
      Domain: dtrv.org
      Provider: Google
      Purpose: Used by Google Analytics to limit the request rate.
      Duration: Browser session

4. Changes to the privacy policy

   1. We reserve the right to change this privacy policy with regard to data processing in order to adapt it to changes in the legal situation, changes to the online offering or changes to data processing.
   2. If the consent of users is required or if parts of the privacy policy contain provisions governing the contractual relationship with users, changes will only be made with the consent of the users.
   3. Users are requested to regularly review the content of this privacy policy.

 

As of: November 2025