If "we" or "us" is used in this data protection notice, this refers to the respective company in accordance with section 2.

2. Data controller

The controller for the processing of your personal data that you share with us is

• FTI Touristik GmbH
  Landsberger Str. 88
  80339 Munich, Germany
   
• Big-Xtra Touristik GmbH
  Landsberger Str. 88
  80339 Munich, Germany
   
• FTI Ticketshop GmbH
  Landsberger Str. 88
  80339 Munich, Germany
   
• Meeting Point Hotelmanagement Holding GmbH
  Landsberger Str. 88
  80339 Munich, Germany
   
• Meeting Point International GmbH
  Landsberger Str. 88
  80339 Munich, Germany

You can contact our data protection officer at: dataprotectionofficer@fti.de

In addition, the respective operator of the aforementioned social media platform is also responsible (hereinafter referred to as the "provider") for data processing on our social media pages.

The respective operator of the social media platform is available to you as a contact person. You can also assert your rights in relation to processing that is carried out under joint responsibility against us. In such cases, we will coordinate with the respective provider in order to answer your request and ensure that your rights as a data subject are protected. Below you will find the providers of the respective channels as well as the contact details of the data protection officer:

• Facebook and Instagram: Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour Dublin 2, Ireland (hereinafter also referred to as „Meta“), online contact form at https://de-de.facebook.com/help/contact/540977946302970;
• Twitter: Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland (hereinafter also referred to as „Twitter“ or "X"), online contact form at https://twitter.ethicspointvp.com/custom/twitter/forms/data/form_data.asp?lang=de;
• YouTube: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter also referred to as „Google“), online contact form at https://support.google.com/policies/contact/general_privacy_form;
• Pinterest: Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland (hereinafter also referred to as „Pinterest“), online contact form at https://help.pinterest.com/de/data-protection-officer-contact-form or by post;
• TikTok (jointly responsible for data processing): TikTok Technology Limited, 10 Earlsfort Court Dublin 2 DUBLIN, D02 AK70, Ireland sowie TikTok Information Technologies UK Limited, One London wall 6th floor, London, EC2Y 5EB (hereinafter collectively referred to as “TikTok”), email to privacy@tiktok.com or by post to: 10 Earlsfort Court Dublin 2 DUBLIN, D02 AK70, Ireland;
• Xing: New Work SE, Am Strandkai 1, 20457 Hamburg, Germany (hereinafter also referred to as „Xing“), email to datenschutzbeauftragter@xing.com or by post;
• LinkedIn: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland (hereinafter also referred to as „LinkedIn“), online contact form at https://www.linkedin.com/help/linkedin/ask/TSO-DPO.

Joint Controllership

For the use of "Page Insights" on Facebook and Instagram, we have defined in a joint controllership agreement with Meta in accordance with Article 26 of the GDPR how the respective tasks and responsibilities for the processing of personal data are structured and who fulfils which data protection obligations. In particular, we have determined how an appropriate level of security and your rights as a data subject can be ensured, how we can jointly fulfil the information obligations under data protection law and how we can monitor potential data protection incidents. This also includes ensuring that we are able to ensure compliance with our reporting and notification obligations.

The "Page Insights Controller Addendum", which governs the corresponding existing joint responsibility between us and Meta with respect to the Page Insights data, is available in full here (https://www.facebook.com/legal/controller_addendum). The essentials of this supplement can be found here (https://www.facebook.com/legal/terms/information_about_page_insights_data).

3. General information on social media offers

We would like to expressly point out that the providers of the social media channels may transfer your personal data to countries other than the one in which you reside and process it there. This may also apply to countries outside the EU or the EEA (so-called third countries). The laws of these countries may not guarantee a level of protection for your personal data comparable to that of your country of origin.

We have no influence on the collection of data and its further use by the provider. In this respect, please refer to the terms of use and data protection notices of the providers for information on the scope of data processing, the manner, in particular on the storage period, deletion practices, evaluation and linking as well as the disclosure of your data. This is neither recognizable nor influenceable for us. It is your responsibility to disclose what data you disclose to the provider and, under certain circumstances, make it public. This also explicitly includes interactive functions of the providers (such as rating, sharing, commenting). You also have the opportunity to get in touch with us through other channels and follow our news and offers.

Relevant information from providers about the use and processing of your data:

4. Data processing on our social media channels

Object of data processing

Personal data is any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Anyone who provides us with other people's personal data must ensure that the data subject agrees that this data can be transferred to us and that he or she understands how we process their personal data and what rights the data subject has.

Purposes and legal bases of data processing

Unless otherwise specified, we process your data with our legitimate interest in accordance with Art. 6 (1) (f). We are interested in using a platform on which we can provide information about our current topics, as well as offering up-to-date information and interaction options and achieving appropriate reach on the respective social media channels.

In the following, we will first inform you about the general purposes of data processing before informing you about the specific features of each social media platform:

• Contatct us directly
  Unless otherwise stated in our following data protection information for social media channels, we process the data of users insofar as they communicate with us within the social networks and platforms, e.g. write posts on our online presences or send us messages. The data is processed by us on the basis of your consent in accordance with Art. 6 (1) (a) GDPR or our legitimate interests in accordance with Art. 6 (1) (f) GDPR.
   
• Usage analysis
  We use the functions offered for usage analysis in connection with our social media presences. This aggregated statistical data provided to us in anonymous form by the providers (e.g. number of likes, page views, click-through rate or demographic information on target groups reached) enables us to gain insights into the types of actions that users take on our site or how they interact with it, as well as to optimize customer contact. Personal data of individual users is not visible to us.
   
• Other user interactions
  If you contact us via the social media presences, e.g. in the form of likes, subscriptions or following our profiles, by rating or commenting on posts, we will use this information, if it has been made public, in aggregate form in order to be able to provide our visitors with relevant and interesting content. The conclusions drawn from this do not allow any conclusions to be drawn about individual users. 
   
• Advertising
  Advertisers of social media sites may provide us with demographic and geographic evaluations of our target audiences, which we may use to highlight posts or place advertisements on social media sites. However, we do not have the ability to identify individual users, but only work with aggregated and anonymized data. If we carry out a comparison with customer lists in order to show you interest-based advertising, this will only take place with your express consent in accordance with Art. 6 (1) (a).

4.1 Facebook und Instagram

Facebook Terms of Use: https://www.facebook.com/legal/terms/ 
Facebook Privacy Policy: https://www.facebook.com/about/privacy 

Instagram Terms of Use: https://help.instagram.com/581066165581870 
Instagram Privacy Policy: https://help.instagram.com/519522125107875 

Usage Analysis

In connection with the operation of our presence on Facebook, Meta, provider of Facebook, provides us with "statistics and insights" with the help of which we gain insights into the types of actions that visitors take on our Facebook pages (so-called "page insights"). Here, trends and statistical information are processed without us being able to identify individual users. For more information, see: https://www.facebook.com/legal/terms/information_about_page_insights_data.

We have signed a joint responsibility agreement with Meta for the use of Page Insights data, which you can call here: https://www.facebook.com/legal/terms/page_controller_addendum.  It states, among other things, that

• our company, together with Meta Platforms Ireland Limited, are joint controllers pursuant to Article 26 of the GDPR for the processing of such data;
• Meta Ireland assumes the fulfilment of the obligations under the GDPR for the processing of Insights data (including Articles 12 and 13 of the GDPR, Articles 15 to 21 of the GDPR, Articles 33 and 34 of the GDPR) and Meta Ireland takes appropriate technical and organisational measures in accordance with Article 32 of the GDPR to ensure the security of the processing.
• Meta Ireland determines, in its sole discretion, how to perform its obligations under this Page Insights Addendum
• the Irish Data Protection Commission (https://www.dataprotection.ie) is the lead supervisory authority for joint processing.

Advertising

As a user of Meta, you can use the "Advertising Preferences" (https://de-de.facebook.com/ads/preferences or https://accountscenter.instagram.com/ad_preferences/) set which data is used to record your user behavior and display advertisements.

4.2 Twitter / X

Terms of service: https://twitter.com/de/tos 
Datenschutzrichtlinie: https://twitter.com/de/privacy 

Usage Analysis

In particular, we receive aggregate data from Twitter on: profile visits, mentions, tweet impressions and interactions (likes, retweets, clicks), follower growth, video content performance, conversion tracking.

Advertising

As a user of , you can use the settings for "Individualization and Data" (https://twitter.com/settings/account/personalization) to set which data is used to record your user behavior inside and outside the platform and to display advertising.

4.3 YouTube

Terms of use: https://www.youtube.com/t/terms 
Privacy Policy: https://policies.google.com/privacy 

Usage Analysis

In particular, we receive aggregate data from Google on: profile visits, impressions and interactions with videos, follower growth, audience (age and gender, region, language preferences, channels and content)

Advertising

As a Google user, you can use the "My Ads Center" (https://myadcenter.google.com/) to set which data is used to record your user behavior and display advertisements.

4.4 Pinterest

Terms of service: https://policy.pinterest.com/de/terms-of-service 
Privacy Policy: https://policy.pinterest.com/de/privacy-policy

Usage Analysis

In particular, we receive aggregate data from Pinterst on: profile visits, impressions and interactions with content (pins), conversions tracking.

Advertising

As a user of Pinterest, you can go to the "My Ads Center" (https://myadcenter.google.com/) to determine which data is used to record your user behavior and display advertisements.

4.5 TikTok

Terms of use: https://www.tiktok.com/legal/terms-of-service
Privacy Policy: https://www.tiktok.com/legal/privacy-policy-eea

Usage Analysis

In particular, we receive aggregated data from TikTok on: profile visits, impressions of our content and interactions (likes, comments, clicks), follower growth, target group (age, gender, devices and region), conversion tracking.

Advertising

As a user of TikTok, you can use the "Security Center" (https://www.tiktok.com/safety/) to set which data is used to record your user behavior and display advertising.

4.6 XING

Terms and conditions: https://www.xing.com/terms 
Privacy Policy: https://privacy.xing.com/en/privacy-policy

Usage Analysis

In particular, we receive aggregated data from XING on: profile visits, impressions of our content and interactions (likes, shares, comments, clicks), target group (demographic/geographical information, XING membership), conversion tracking.

Advertising

As a user of XING, you can use the settings for "Advertising Measurement and Optimization" (https://www.xing.com/jobs/find?showUserConsentBanner=1) to set which data is used to record your user behavior and display advertising.

4.7 LinkedIn

User Agreement: https://www.linkedin.com/legal/user-agreement 
Privacy Policy: https://www.linkedin.com/legal/privacy-policy 

Usage Analysis

We receive aggregated data from LinkedIn in particular on: profile visits, impressions of our content and interactions (likes, shares, comments, clicks), target group (demographic information, LinkedIn membership), conversion tracking.

Advertising

As a LinkedIn user, you can use the "LinkedIn Ads Settings" (https://www.linkedin.com/psettings/advertising) to set which data is used to record your user behavior and display advertising.

5. Recipients and legal basis for transfers to third countries

Within our company, access to your data will only be granted to those departments or persons who need it to perform their respective tasks in connection with the processing activities referred to in this Privacy Notice.

Please note that we may transfer and process personal data in countries other than your country of residence. This may also apply to countries outside Switzerland, the EU or the EEA (so-called third countries). The laws of these countries may not guarantee a level of protection for your personal data comparable to that of your country of origin.

If we transfer your personal data to such a country, we will ensure that the transfer is in accordance with the requirements of Art. 45 et seq. GDPR or Art. 16 et seq. FADP. We will only transfer your personal data to third countries if there is an adequacy decision by the EU Commission or a decision by the Federal Council for that country or if appropriate safeguards are in place, including EU standard contractual clauses or standard data protection clauses recognised by the FDPIC. Information and copies of this can be requested by you from the contact provided.

6. Automated decision-making, including profiling

Automated decision-making by us (including profiling) does not take place.

7. Duration of storage of personal data

We process and store your personal data only for as long as is necessary to fulfil the purpose for which it was collected. Thereafter, we delete or anonymise your personal data, with the exception of data that we are required to continue to store in order to comply with legal obligations (e.g. we are obliged to keep documents such as business letters, contracts and invoices for a certain period of time due to retention periods under tax and commercial law) or retain them within the framework of the statutory statute of limitations for the assertion, exercise or defence of legal claims.

For information on the storage period and data deletion by the providers of the platforms, please refer to the providers' privacy policies listed above.

8. Your rights as a data subject

As a data subject, you have various rights under the GDPR, which arise in particular from Articles 15 to 18 and 21 of the GDPR. Please note that we will need to verify your identity before we can comply with your request to exercise your data protection rights. This practice allows us to protect our customers' personal data from fraudulent requests.

• Right of access
  You may request information in accordance with Art. 15 GDPR about your personal data processed by us. In your request for information, you should specify your request in order to make it easier for us to compile the necessary data. Please note that under certain circumstances, your right of access may be limited in accordance with the law. 
   
• Right to rectification
  If the information concerning you is no longer correct, you can request a correction in accordance with Art. 16 GDPR. If your data is incomplete, you can request that it be completed. 
   
• Right to erasure
  You may request the deletion of your personal data under the conditions of Art. 17 GDPR. Your right to deletion depends, among other things, on whether the data concerning you is still required by us to fulfil our legal tasks or whether we have a legitimate interest in storing it.
   
• Right to restriction of processing
  Within the framework of the provisions of Art. 18 GDPR, you have the right to request a restriction of the processing of data concerning you.
   
• Right to data portability
  According to Art. 20 GDPR, you have the right to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format or to request that it be transmitted to another controller, insofar as this is technically feasible.
   
• Right to object
  In accordance with Art. 21 GDPR, you have the right to object at any time to the processing of data concerning you on grounds relating to your particular situation. However, we are not always able to comply with this, e.g. if legal provisions oblige us to process data as part of our official duties.
   
• Withdraw your consent
  If we rely on your consent as the legal basis for processing your personal data, you may withdraw that consent at any time.

Exercising your rights

If you have any questions about data processing by our company, please contact us directly. In order to revoke your consent to the use of data, to assert a right to information or the correction, blocking or deletion of your data, or to exercise the other rights of data subjects mentioned above, please contact the data protection officer named in section 2.

We recommend that you assert requests for information and other data subject rights regarding the social media channels used directly with the respective operator of the platform, as this alone has direct access to the data and information and can take all necessary measures to protect your rights as a data subject.

Here you can find out how you can assert your rights as a data subject against the provider of the respective platform:

Right to lodge a complaint

If you believe that we have not complied with data protection regulations when processing your data, you can lodge a complaint with a supervisory authority. The supervisory authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach.

For Facebook, Instagram, Twitter, LinkedIn, YouTube, Pinterest and TikTok Ireland, this is the Irish Data Protection Commission (https://www.dataprotection.ie), for TikTok UK this is also the Information Commissioner's Office UK (https://ico.org.uk) and for Xing the Hamburg Commissioner for Data Protection and Freedom of Information (https://datenschutz-hamburg.de).

9. Changes to this Privacy notice

This document is subject to periodic revision or supplementation.

30. April 2024