1. Scope and Definitions

The following data protection information provides you with an overview of the collection and processing of your personal data in connection with the provisional insolvency proceedings, the insolvency insurance of tour operators (travel protection fund, German: "Reisesicherungsfonds") and your rights as a data subject.

This privacy notice applies to the following companies:

• FTI Touristik GmbH
• BigXtra Touristik GmbH
• FTI Flight Trading GmbH
• Meeting Point Hotelmanagement Holding GmbH
• Meeting Point International GmbH

Please also note our separate data protection notices, which provide you with more detailed information about other data processing carried out by the companies: www.fti-group.com/en/privacy.

When "we" or "us" is used in this data protection notice, the respective controller is referred to in section 2.

2. Data Controller

The controller of your personal data is the company with which you have a business, contract or contractual relationship:

• FTI Touristik GmbH
  Landsberger Straße 88, 80339 Munich, Germany
   
• BigXtra Touristik GmbH
  Landsberger Straße 88, 80339 Munich, Germany
   
• FTI Flight Trading GmbH
  Landsberger Straße 88, 80339 Munich, Germany
   
• Meeting Point Hotelmanagement Holding GmbH
  Landsberger Straße 88, 80339 Munich, Germany
   
• Meeting Point International GmbH
  Landsberger Straße 88, 80339 Munich, Germany

You can reach our data protection officer at dataprotectionofficer@fti.de.

3. Purposes, legal basis and duration of data processing

In accordance with the statutory provisions, we only collect and process personal data from you that are necessary in connection with the insolvency proceedings, in particular for the fulfilment of the obligations arising from the Insolvency Code ("InsO") and for the fulfilment of the obligations arising from the insolvency insurance for tour operators ("Reisesicherungsfonds").

Personal data is any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical,  physiological, genetic, psychological, economic, cultural or social identity of that natural person.

Categories

The categories of data processed include, in particular, pre-existing data, such as contact details, booking information including bank details, payment and contract data, claim data, birth and civil status data and insurance data.

In connection with the processing of package travel contracts via Deutsche Reisesicherungsfonds GmbH ("DRSF"), we may process the following categories of data in particular, which must be provided by FTI Touristik GmbH and BigXtra Touristik GmbH: title, first and last name, date of birth, number of children and adults booked, first and last name and date of birth of fellow travellers; residential address with street, postcode and country of residence; Contact details such as mobile phone number and email address; Payment data such as full bank details; Booking data for the trip, such as the start and duration of the trip, the location of the trip and the individual travel services booked; Details of advance payments and other fees already paid. Further details can be found in the DRSF's privacy policy at: https://drsf.reise/datenschutz/.

Provision of personal data

In connection with the insolvency proceedings , debtors are legally obliged to provide personal data: Debtors are obliged to provide information and cooperation to the court, a court-appointed expert and the (provisional) insolvency administrator from the insolvency application procedure onwards (§§ 4, 5 InsO in conjunction with § 404a ZPO, §§ 22 para. 3, 97 para. 1 InsO). If the debtor does not comply with this, the court can enforce this by means of coercive measures (§§ 22 para. 3, 98 InsO).

Legal bases

In the context of insolvency proceedings, the main legal bases are processing on the basis of legal requirements (Art. 6 para. 1 lit. c) GDPR) or in the public interest (Art. 6 para. 1 lit. e) GDPR) in conjunction with the provisions of the Insolvency Code (InsO).

Insofar as the processing of your data is carried out in connection with the insolvency insurance of tour operators (travel protection fund), Art. 6 para. 1 lit. c) GDPR serves as the legal basis, in particular in conjunction with §§ 651r et seq. of the German Civil Code ("BGB"), the Travel Security Fund Act ("RSG") and the Travel Security Fund Ordinance ("RSFV").

Insofar as the processing of your data is necessary to comply with a legal obligation, Art. 6 para. 1 lit. c) GDPR serves as the legal basis.

If the processing of your data is in connection with the performance of a contract to which you are a party, Art. 6 para. 1 lit. b) GDPR serves as the legal basis. This also includes the implementation of pre-contractual measures at the request of you as the data subject.

Insofar as we obtain your consent for processing operations, Art. 6 para. 1 lit. a) GDPR serves as the legal basis for the processing of personal data.

If the processing is necessary to safeguard a legitimate interest of our company or a third party and the interests, fundamental rights and freedoms of you as a data subject do not outweigh the first-mentioned interest, Art. 6 para. 1 lit. f) GDPR serves as the legal basis for the processing.

Duration of personal data retention

We process and store your personal data only for as long as is necessary to fulfil the purpose for which it was collected. After that, we delete or anonymise your personal data, with the exception of data that we must continue to store in order to comply with legal obligations (e.g. we are obliged to retain documents such as business letters, contracts and invoices for a certain period of time due to retention periods under tax and commercial law) or to store them within the framework of the statutory statute of limitations for the assertion, exercise or defence of legal claims.

4. Recipients

Within our company, your data will only by accessed by those departments or individuals who need it to perform their respective tasks in connection with the processing activities referred to in this privacy notice.

Depending on the individual case, external recipients may use third parties commissioned to process your data (e.g. service providers for the technical infrastructure and maintenance of our communication systems), public bodies (such as courts, financial or law enforcement authorities) or private bodies (such as credit agencies) as well as group companies of the FTI GROUP.

In connection with the insolvency proceedings, the (provisional) insolvency administrator, the insolvency court, consulting firms or law firms, tax consultants, auditors or comparable consulting service providers as well as supporting service providers are possible recipients.

The following was appointed as provisional insolvency administrator for the companies FTI Touristik GmbH, BigXtra Touristik GmBH and FTI Flight Trading GmbH:

• Lawyer Axel Bierbach
  Herzog-Heinrich-Straße 9
  80336 Munich, Germany
  E-mail: datenschutz@mhbk.de

The following was appointed as provisional insolvency administrator for the companies Meeting Point Hotelmanagement Holding GmbH and Meeting Point International GmbH:

• Lawyer Oliver Schartl
  Herzog-Heinrich-Straße 9
  80336 Munich, Germany
  E-mail: datenschutz@mhbk.de

In order to process the legal obligations arising from the insolvency insurance of tour operators (travel protection fund), data transfer will take place to:

• Deutsche Reisesicherungsfonds GmbH
  Sächsische Straße 1
  10707 Berlin, Germany
  E-Mail: datenschutz@drsf.reise

The DRSF is obliged to keep the confidential information provided to it confidential and to protect it from access by third parties.

5. Automated decision-making, including profiling

Automated decision-making (including profiling) does not take place.

6. Your rights

As a data subject, you have various rights under the GDPR, which result in particular from Art. 15 to 18 and 21 GDPR. Please note that we must verify your identity before we can comply with your request to exercise your data protection rights. This practice allows us to protect our customers' personal information from fraudulent requests.

• Right to information
  You can request information in accordance with Art. 15 GDPR about personal data concerning you processed by us. In your request for information, you should specify your request to make it easier for us to compile the necessary data. Please note that in certain circumstances, your right to access may be limited by law.
   
• Right to rectification
  If the information concerning you is not (or no longer) accurate, you can request correction in accordance with Art. 16 GDPR. If your data is incomplete, you can request that it be completed.
   
• Right to erasure
  You can request the deletion of your personal data under the conditions of Art. 17 GDPR. Your right to erasure depends, among other things, on whether the data concerning you is still required by us to fulfil our statutory tasks or whether we have a legitimate interest in storing it.
   
• Right to restriction of processing
  Within the framework of the provisions of Art. 18 GDPR, you have the right to demand a restriction of the processing of data concerning you.
   
• Right to data portability
  In accordance with Art. 20 GDPR, you have the right to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format or to request that it be transmitted to another controller, insofar as this is technically feasible.
   
• Right to object
  In accordance with Art. 21 GDPR, you have the right to object to the processing of data concerning you at any time for reasons arising from your particular situation. However, we cannot always comply with this, e.g. if legal provisions oblige us to process data as part of the fulfilment of our official duties.
   
• Revocation of your consent
  If we rely on your consent as a legal basis for processing your personal data, you may withdraw that consent at any time.

Exercising your rights

To revoke your consent to the use of data, to assert a right to information or the correction, blocking or deletion of your data, or to exercise the other rights of the data subject mentioned above, please contact:

• FTI Touristik GmbH
  Attn: Data Protection Officer (DPO)
  Landsberger Str. 88, 80339 Munich, Germany
  E-Mail: datenschutz@fti.de
   
• BigXtra Touristik GmbH
  Attn: Data Protection Officer (DPO)
  Landsberger Str. 88, 80339 Munich, Germany
  E-Mail: datenschutz@bigxtra.de
   
• FTI Flight Trading GmbH
  Attn: Data Protection Officer (DPO)
  Landsberger Str. 88, 80339 Munich, Germany
  E-Mail: datenschutz-ftiflighttrading@fti.de
   
• Meeting Point Hotelmanagement Holding GmbH
  Attn: Data Protection Officer (DPO)
  Landsberger Str. 88, 80339 Munich, Germany
  E-Mail: dataprotection@mphotels.com
   
• Meeting Point International GmbH
  Attn: Data Protection Officer (DPO)
  Landsberger Str. 88, 80339 Munich, Germany
  E-Mail: dataprotection@meetingpointint.com

Of course, you are entitled to your data protection rights free of charge, without incurring higher transmission costs than for the basic rates for submitting your request.

Right to lodge a complaint

If you believe that we have not complied with data protection regulations when processing your data, you can lodge a complaint with a supervisory authority. As a rule, you can contact the supervisory authority of your usual place of residence or place of work or our company headquarters. The supervisory authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.

This document is subject to regular amendment or supplementation.