Beautiful Destinations Booking GmbH Privacy Policy

Your privacy is paramount to us. This document outlines how we handle your personal data in our online services, including our website and mobile applications. We'll guide you through the types of data we collect, the purpose of collecting this data, and your rights regarding your personal information.

Who We Are

Responsible Entity:

Beautiful Destinations Booking GmbH

Official Address:

c/o GoTiger GmbH, Jägerstrasse 32, 10117, Berlin, Germany

Managing Directors:

Saad Saeed and Jeremy Jauncey

Contact for Inquiries:

Reach us at info@beautifuldestinations.app

Legal Registration:

Registered under the Berlin District Court

Commercial Register number HRB 247135 B

Key Terms Explained

Data We Process:
- Inventory Data: This includes personal details such as your name and address that we collect for managing your bookings and services.
- Contact Data: This comprises your email addresses and phone numbers, which we use for communication purposes.
- Meta/Communication Data: This includes technical data like your device's information and IP addresses, which help us in maintaining the security and performance of our services.
Affected Individuals: Our policies apply to all users of our mobile app and visitors to our online platform.
Purpose of Data Processing:
- Communication: We use your data to respond to your queries, provide customer support, and keep you informed.
- Security: To safeguard our services against threats and unauthorized access.
- Marketing and Analytics: To understand user preferences, improve our offerings, and send you information about products and services that might interest you.

Newsletter and Communication

Frequency and Content: Expect our newsletter roughly twice per quarter, containing updates and offers.
Subscription Control: You have complete freedom to subscribe and unsubscribe at any time.
Data Usage for Newsletter: We track subscription success, employ third-party shipping services, and log registrations for efficiency and improvement purposes.

Defining Personal Data and Processing

Personal Data: Refers to any information that can be used to identify you, either directly or indirectly.
Processing: Encompasses all actions taken with your personal data, such as collection, storage, and usage.
Pseudonymization: A method where your personal data is processed in a way that it cannot be linked back to you without additional, separately stored information.
Profiling: Automated data processing to evaluate certain personal attributes, like preferences and behavior.
Controller vs. Processor: 'Controller' refers to us, as we decide the purpose and means of processing your personal data. 'Processor' would be any other entity we use to process this data on our behalf.

Legal Basis for Our Data Processing

Obtaining Consent: We process your data based on your consent in accordance with Art. 6 Para. 1 lit. a and Art. 7 GDPR.
Fulfilling Services: The processing necessary for our service delivery is based on Art. 6 Para. 1 lit. b GDPR.
Legal Compliance: For fulfilling legal obligations, we rely on Art. 6 Para. 1 lit. c GDPR.
Legitimate Interests: We process data for legitimate interests as per Art. 6 Para. 1 lit. f GDPR, unless overridden by your data protection interests.
Protecting Vital Interests: In scenarios where processing is essential for someone's vital interests, we use Art. 6 Para. 1 lit. d GDPR as our legal basis.

Security Measures and Cooperation with Processors and Third Parties

Ensuring Your Data's Security

At Beautiful Destinations Booking GmbH, we prioritize the security of your personal data. In line with Article 32 of the GDPR, we implement robust technical and organizational measures to protect your data. This includes:

Risk-Based Approach: We consider factors like technology state, implementation costs, data nature, processing scope, and potential risks to your rights and freedoms.
Data Protection Strategies: These include ensuring data confidentiality, integrity, and availability. We control physical and digital access to data, oversee data input, transmission, storage, and enforce data separation.
Proactive Measures: We have set up processes to uphold your data rights, manage data deletion, and address data breaches. Our technology choices are made with data protection in mind, adhering to the principles of data protection by design and default settings (Article 25 GDPR).

Working with Processors and Third Parties

Data Sharing: When we share your data with third parties (like payment service providers or web hosts), it's based on legal grounds such as contractual necessity (Art. 6 Para. 1 lit. b GDPR), your consent, legal obligations, or our legitimate interests.
Contractual Safeguards: If we use third parties to process data, it's under a strict "order processing contract" as per Article 28 GDPR.

Special Note on Layla Chatbot

Our Layla Chatbot, available from January 1, 2023, is covered by its specific Terms of Service, which you agree to upon use. This service may involve interactions with third-party services, all within these terms. These Terms of Service are an extension of this Privacy Policy and should be reviewed for a comprehensive understanding of your data rights related to the chatbot.

International Data Transfers

Outside EU/EEA Processing: We may process data outside the EU or EEA in certain cases, like to meet contractual obligations, based on your consent, due to legal requirements, or driven by our legitimate interests.
Compliance with GDPR Standards: Data processing in third countries follows GDPR stipulations (Art. 44 ff.), ensuring EU-equivalent data protection levels (e.g., via mechanisms like the "Privacy Shield" in the USA) or adherence to specific contractual obligations (like "standard contractual clauses").

Understanding Your Data Rights

Your Rights Over Your Data

As a user of Beautiful Destinations Booking GmbH, you have specific rights under the GDPR regarding your personal data:

Access and Copies of Data (Art. 15 GDPR): You can ask us to confirm if we're processing your data and, if so, access that data and receive additional information about it, including a copy.
Data Correction (Art. 16 GDPR): If you find that your data with us is incomplete or incorrect, you have the right to have it completed or corrected.
Data Deletion and Restriction (Art. 17 & 18 GDPR): You can request the immediate deletion of your data or, alternatively, limit the processing of your data under certain conditions.
Data Portability (Art. 20 GDPR): You have the right to receive the data you've provided to us in a structured, commonly used format, and to have this data transmitted to another party.
Complaints to Authorities (Art. 77 GDPR): If you believe your data is being mishandled, you have the right to lodge a complaint with the relevant supervisory authority.

Your Right to Withdraw Consent

Revoking Consents (Art. 7 Para. 3 GDPR): Any consent you’ve granted for data processing can be withdrawn at any time, with future effect.

Your Right to Object

Objection to Processing (Art. 21 GDPR): You can object to the processing of your data, especially for direct marketing purposes, at any time.

Cookies and Advertising

Understanding Cookies: Cookies are small files stored on your device to save information during or after your visit to our online service. They can be temporary (session cookies) or permanent.
Managing Cookies: You can disable cookies in your browser settings and delete existing ones. However, this might affect the functionality of our services.
Opting Out of Online Marketing Cookies: You can opt-out of cookies used for online marketing at sites like www.aboutads.info/choices (US) or www.youronlinechoices.com (EU).

Data Deletion and Retention

Our Approach to Data Deletion: In line with GDPR Articles 17 and 18, we promptly delete or restrict the processing of data that is no longer needed, except where required for legal reasons like taxation or commercial record-keeping.
Specific Retention Periods: In Germany and Austria, we adhere to local statutory retention requirements. Globally, we comply with each jurisdiction’s data retention laws.
Requesting Data Deletion: To request the deletion of your data collected through our app or chatbot, please contact us via email at contact@beautifuldestinations.app. Provide your name and details of your request. We aim to process such requests promptly and will notify you of the outcome within a reasonable timeframe.

Simplified Summary

You have various rights over your data, including access, correction, deletion, and objection to processing. We use cookies to enhance your experience, which you can manage or opt out of. Data is kept only as necessary and in compliance with legal standards. For data deletion requests, please contact us.

Staying Updated and Getting in Touch:

We will inform you of any policy changes. For further details or questions, please contact our Data Protection Officer at contact@beautifuldestinations.app.

How We Handle Your Data in Our Services

Agency Services

Services and Data Types: In our contractual services, which include strategic consulting, campaign planning, software/design development and consulting, campaign implementation, server administration, data analysis, and training services, we process:
- Inventory Data: Customer master data like names, addresses.
- Contact Data: Email addresses, telephone numbers.
- Content Data: Text input, photographs, videos.
- Contract Data: Subject matter of the contract, terms.
- Payment Data: Bank details, payment histories.
- Usage and Meta/Data: Related to marketing measure evaluation and success.
Special Categories: We only process special categories of personal data if they are part of a commissioned processing.
Data Subjects: Include customers, prospects, their customers, users, website visitors, mobile apps’ users, or employees, and third parties.
Processing Purpose: The data is processed for providing our contractual services, billing, and customer service.
Legal Basis: Processing is based on Art. 6 para. 1 lit. b GDPR (contractual services) and Art. 6 para. 1 lit. f GDPR (analysis, statistics, optimization, security measures).
Disclosure Necessity: We process data necessary for the establishment and fulfillment of contractual services and disclose data to external parties only when required within an order's framework.
Order Processing Compliance: In processing data within the scope of an order, we follow client instructions and legal requirements as per Art. 28 GDPR.
Data Deletion Policy: Data is deleted following the expiry of legal warranty and comparable obligations. The necessity of retaining data is reviewed every three years. Legal archiving obligations dictate deletion after expiry (6 years according to § 257 para. 1 HGB and 10 years according to § 147 para. 1 AO). Data disclosed to us by the client within the scope of an order is deleted as per the order specifications, usually after the order's completion.

Contractual Services

Data Processing of Contract Partners: We process data of our contract partners and interested parties (collectively referred to as "contract partners") under Art. 6 para. 1 lit. b GDPR to provide them with our contractual or pre-contractual services.
Processed Data Types: Include master data (names, addresses), contact data (email, telephone numbers), contract data (services used, contents, communication), and payment data (bank details, payment history).
Special Categories: Processing of special categories of personal data occurs only if part of a commissioned or contractually agreed processing.
Disclosure and Processing Instructions: Data necessary for the establishment and fulfillment of contractual services is processed, highlighting the necessity of disclosure. We share data with external entities if required within a contract's scope. We follow the instructions of our clients and legal requirements in processing data within an order's scope.
IP Address and User Action Storage: The IP address and time of user actions are stored based on our legitimate interests and the users' interest in protection against misuse (Art. 6 para. 1 lit. f GDPR). This data is generally not transferred to third parties unless necessary for our claims or there is a legal obligation (Art. 6 para. 1 lit. c GDPR).
Data Deletion: Data is deleted when no longer necessary for fulfilling contractual or statutory fiduciary duties, with regular reviews every three years; statutory retention obligations apply.

Administration, Financial Accounting, Office Organization, Contact Management

Scope of Processing: We process data as part of administrative tasks, business organization, financial accounting, and legal obligations like archiving.
Processed Data and Legal Basis: The same data we process in providing our contractual services are processed here, based on Art. 6 para. 1 lit. c and f GDPR.
Affected Parties: This includes customers, interested parties, business partners, mobile apps’ users and website visitors.
Purpose and Interest: The processing is for administration, financial accounting, office organization, archiving of data – tasks essential for maintaining our business activities, fulfilling our tasks, and providing our services.
Data Deletion: The data related to contractual services and communication is deleted as per the guidelines in the processing activities.
Data Disclosure: We may disclose or transmit data to financial authorities, consultants (like tax advisors, auditors), fee offices, and payment service providers.
Storage of Business Contact Data: Based on business interests, we store information on suppliers, event organizers, and other business partners, usually on a long-term basis.

Contacting Us

Data Processing on Contact: When users contact us (via contact form, email, telephone, or social media), their details are processed to handle the request based on Art. 6 para. 1 lit. b (contractual/pre-contractual relationships) and lit. f (other inquiries) GDPR.
Data Storage: User data may be stored in a CRM System or similar request organization system.
Review and Deletion of Requests: We delete requests when no longer required, with a review every two years for necessity; legal archiving obligations also apply.

Newsletter Information and Subscription Process

Newsletter Content and Agreement

Content Overview: Our newsletters provide information about our services and related advertising content. We send these only with the explicit consent of the recipients or under legal permission.
Consent Process: Subscription to our newsletter involves a double opt-in procedure. After signing up, you'll receive an email to confirm your subscription. This ensures that no one can subscribe with another person's email.
Purpose of Double Opt-In: This process helps us comply with legal requirements by verifying that the consent is genuine.
Registration Data: To subscribe, only your email address is required. Optionally, you can provide your name for a personalized experience.

Consent and Legal Basis for Dispatch

Based on Consent: The newsletter dispatch and performance measurement are conducted with your consent, in accordance with Art. 6 para. 1 lit. a and Art. 7 GDPR, combined with § 7 para. 2 no. 3 UWG (German Act Against Unfair Competition).
Legitimate Interest: If consent is not explicitly required, our newsletter is based on our legitimate interest in direct marketing (Art. 6 para. 1 lt. f GDPR in conjunction with § 7 para. 3 UWG).
Logging for Consent Verification: The registration process logging, including time and IP address, is part of our legitimate interests (Art. 6 para. 1 lit. f GDPR) to maintain a secure and user-friendly newsletter system.

Cancellation and Revocation Rights

Easy Unsubscription: You can cancel the newsletter anytime, revoking your consent. An unsubscription link is provided in every newsletter.
Data Retention Post-Unsubscription: We may retain unsubscribed email addresses for up to three years for legal reasons, to prove previous consent. This data is only processed for potential defense against claims. However, you can request deletion at any time, provided you acknowledge the prior existence of consent.

Hosting and Email Dispatch Services

Services Provided by Hosting

Scope of Hosting Services: We use hosting services for infrastructure, computing capacity, storage, database services, email dispatch, security, and technical maintenance necessary for operating our online platform.
Data Processed by Hosting Provider: In collaboration with our hosting provider, we process inventory data, contact data, content data, contract data, usage data, meta and communication data of customers, interested parties, and visitors of our online platform.
Legal Basis and Order Processing Contract: The processing is based on our legitimate interests in efficient and secure provision of our online services (Art. 6 para. 1 lit. f GDPR), in line with Art. 28 GDPR (conclusion of order processing contract).

Data Collection, Analytics, and Online Presence Information

1. Collection of Access Data and Log Files

Data Collection Details: Every access to our server is logged by our hosting provider, capturing data such as:
- Website and file accessed, date and time of access, data volume transferred.
- Notification of successful access, browser type/version, user's operating system.
- Referrer URL (the previously visited page), IP address, requesting provider.
Retention for Security Reasons: Log file information is stored for up to 7 days for security purposes (e.g., investigating misuse or fraud). Data required for evidence in legal cases are exempt from deletion until the issue is fully resolved.

2. Google Analytics

Usage and Data Processing: We use Google Analytics to evaluate user interactions with our site. This service uses cookies to generate data about site usage, typically sent to and stored on Google servers in the USA.
Privacy Shield Compliance: Google adheres to the Privacy Shield Agreement, ensuring compliance with European data protection law (Privacy Shield Participant).
IP Anonymization: We use Google Analytics with activated IP anonymization. Full IP addresses are only sent to Google servers in the USA and shortened there in exceptional cases.
Opt-Out Options: Users can prevent cookie storage through their browser settings and prevent Google from processing their data by downloading and installing this browser plugin: Google Analytics Opt-out.
Further Information: For details on Google's data usage, privacy policy, and ad settings, visit Google's Privacy Policy and Google Ad Settings.
Data Retention: User data are deleted or anonymized after 14 months.

3. SmartLook

Objective and Consent: SmartLook is utilized to gain insights into user behavior on our mobile apps and website. Explicit consent is obtained for tracking, with the option to opt out.
Data Collected: Includes device IP address (anonymized), screen size, device type, browser information, geographic location (country only), and preferred language.
User Profile and Data Security: Information is stored in pseudonymized profiles. For more on SmartLook's data security, refer to Smartlook Data Security.

4. Google Universal Analytics

Cross-Device Analysis: We employ Universal Analytics for cross-device tracking of user behavior, based on pseudonymous user IDs.
User Consent for Tracking: Informed consent is obtained for this level of tracking and analysis.

5. Online Presence in Social Media

Platforms and Communication: We maintain active presences on social networks and platforms for user interaction and information sharing.
User Data Processing: User data are processed when they interact with us on these platforms, under the terms and data processing guidelines of the respective operators.

6. Facebook Social Plugins

Plugins and Data Collection: We use Facebook plugins to enable users to interact with Facebook content through our mobile apps and website.
User Control: Users can prevent data collection by logging out of Facebook, deleting cookies, and adjusting privacy settings (Facebook Profile Settings).

7. Instagram Integration

Content and Functions: Our mobile apps and website integrate features from Instagram. Users who are members of Instagram can have their interactions linked to their Instagram profiles.
Privacy Details: For Instagram's data handling policies, visit Instagram Privacy.

8. Integration of Third-Party Services and Content

Content and Service Integration: Our online offer integrates various types of content and services from third-party providers. This includes, but is not limited to, videos, fonts, tools for analytics, marketing, and customer interaction. Each integration enhances the user experience and functionality of our services.
List and Purpose of Third-Party Services:
- Video Platforms: For embedding video content (e.g., YouTube, Vimeo), providing multimedia content directly on our platform.
- Font Libraries: Services like Google Fonts or Adobe Fonts for consistent and enhanced typography.
- Analytics Tools: Tools such as Google Analytics or SmartLook for understanding user behavior and improving our service.
- Marketing Tools: Various tools for advertising, user engagement, and conversion tracking.
- Customer Support Tools: Integration of customer support services and chatbots for better user assistance.
IP Address Utilization:
- Necessity for Service Delivery: The IP address of users is necessary for delivering content from third-party servers to user browsers.
- Data Protection Measures: We ensure these providers use the IP address solely for content delivery and maintain privacy standards.
Pixel Tags and Cookies:
- Usage by Third Parties: Third-party providers may employ pixel tags (invisible graphics, also known as “web beacons”) and cookies for statistical analysis or marketing purposes.
- Data Collected: These tools can gather data on visitor traffic, user behavior, browser and operating system information, and more.
- User Control: Users are informed about cookie usage and have control over cookie settings in their browsers. We provide clear information on how users can opt out of tracking and analytics tools.
Data Processing Agreements with Third Parties:
- Compliance and Agreements: We ensure all third-party service providers are compliant with GDPR and other applicable data protection laws. Data processing agreements are in place with these providers to safeguard user data.
User Consent and Transparency:
- Obtaining Consent: Explicit consent is obtained from users for the use of certain third-party services, especially those involving tracking and personal data processing.
- Information Accessibility: We provide detailed information about each third-party service, its purpose, and data processing practices, ensuring users are fully informed.

Auf Deutsch umstellen