3.2 Processing your request

We process personal data to process customer requests and complaints before and/or after the trip. In order to be able to process and understand the facts of the case concretely, it may be necessary to make enquiries, e.g. with service providers. You may also be required to provide us with sensitive information such as accident reports, medical records, death certificates, etc.

In connection with the processing of customer requests, the following categories of personal data may be processed: first and last name, address, mobile phone number, landline number, date of birth, nationality, e-mail address, title, booking number, file key, information on marital status and children, IP address, account data, transaction data, as well as all data transmitted by you in the context of your request

In addition, to the extent necessary to process your request, we process in particular the following special categories of personal data: degree of disability, mark (severely disabled person's pass), validity of the severely disabled person's pass, state of health, vaccination status, diagnosis, ethnic origin, nationality and all data transmitted by you in the context of your request.

Insofar as the processing of your personal data is necessary for the performance of the contract concluded with you, the legal basis for the processing of your personal data is Art. 6 (1) lit. b) GDPR. Insofar as you assert legal claims in the context of your complaint, the legal basis is Art. 6 (1) lit. f) GDPR. Our legitimate interest is to defend against legal claims. Insofar as the processing of your personal data is necessary for the processing of other concerns, the processing is based on Art. 6 (1) (a) GDPR. Insofar as the processing of special categories of personal data is necessary for the processing, the processing is based on Art. 9 (2) lit. a) GDPR.

Depending on the nature of the request, your personal data will be forwarded to the following categories of recipients in order to process your request: insurance companies, destination agencies, service providers for the booked travel service (such as airlines, hotels, car rental companies), booking travel agency, IT service providers, law firms, courts.

3.3 Assertion of legal claims

In the context of fraud prevention as well as in the event of late or incomplete deposit or final payment, we reserve the right to take the necessary steps in individual cases.

For identity confirmation and address verification, we may process the following categories of personal data and: name, address.

In this case, the processing of your personal data is based on Art. 6 (1) lit. f) GDPR. Our legitimate interest is to minimise the risk of non-payment.

In this context, your personal data will be forwarded to the following categories of recipients: Service providers for address validation and address verification.

In connection with the assertion of legal claims (such as due payment claims), the following categories of personal data may also be processed: name, address, information about the booking and the outstanding claim.

In this case, the processing of your personal data is based on Art. 6 (1) lit. b) GDPR. Insofar as receivables are assigned to debt collection agencies or the collection of the receivables is outsourced to them, the processing is based on Art. 6 (1) lit. f) GDPR. The legitimate interest in this case is to obtain compensation for the non-payment of the data subject and to reduce the amount of work required to recover individual claims.

In order to assert legal claims, your personal data will be transferred to the following categories of recipients: other FTI GROUP companies, law firms, debt collection agencies.

3.4 Responding to official inquiries

Authorities may request information about individual customers. This could happen, for example, in the case of a missing person report or in the context of the investigation of crimes. In such cases, we will provide information to the relevant authority if this is legally permissible.

In the context of responding to government requests, the following categories of personal data may be processed: name, destination, travel period and other information requested by the authority.

In this case, the processing of your personal data is based on Art. 6 (1) (c) GDPR in conjunction with the respective legal basis for the asserted right to information.

In order to respond to official requests, your personal data will be forwarded to the following categories of recipients: Requesting authorities.

4. Legal basis for transfers to third countries

Within our company, access to your data will only be granted to those departments or persons who need it to perform their respective tasks in connection with the processing activities referred to in this Privacy Notice.

Please note that we may transfer and process personal data in countries other than your country of residence. This may also apply to countries outside the EU or the EEA (so-called third countries). The laws of these countries may not guarantee a level of protection for your personal data comparable to that of your country of origin. If we transfer your personal data to such a country, we will ensure that the transfer is in accordance with the requirements of Art. 45 et seq. GDPR. We will only transfer your personal data to third countries if they have an adequacy decision by the EU Commission or if appropriate safeguards, including EU standard contractual clauses, are in place. Information and copies of this can be requested by you from the contact provided.

5. Automated decision-making, including profiling

Automated decision-making (including profiling) does not take place.

6. Duration of retention of personal data

We process and store your personal data only for as long as is necessary to fulfil the purpose for which it was collected. Thereafter, we delete or anonymise your personal data, with the exception of data that we are required to continue to store in order to comply with legal obligations (e.g. we are obliged to keep documents such as business letters, contracts and invoices for a certain period of time due to retention periods under tax and commercial law) or retain them within the framework of the statutory statute of limitations for the assertion, exercise or defence of legal claims.

7. Your rights

As a data subject, you have various rights under the GDPR, which arise in particular from Articles 15 to 18 and 21 of the GDPR. Please note that we will need to verify your identity before we can comply with your request to exercise your data protection rights. This practice allows us to protect our customers' personal data from fraudulent requests.

• Right of access
  In accordance with Art. 15 GDPR, you can request information about your personal data processed by us. In your request for information, you should specify your request in order to make it easier for us to compile the necessary data. Please note that under certain circumstances, your right of access may be limited in accordance with the law.
   
• Right to rectification
  If the information concerning you is no longer correct, you can request a correction in accordance with Art. 16 GDPR. If your data is incomplete, you can request that it be completed.
   
• Right to erasure
  Under the conditions of Art. 17 GDPR, you can request the deletion of your personal data. Your right to deletion depends, among other things, on whether the data concerning you is still required by us to fulfil our legal tasks or whether we have a legitimate interest in storing it.
   
• Right to restriction of processing
  Within the framework of the provisions of Art. 18 GDPR, you have the right to request a restriction of the processing of data concerning you.
   
• Right to data portability
  According to Art. 20 GDPR, you have the right to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format or to request that it be transmitted to another controller, insofar as this is technically feasible.
   
• Right to object
  In accordance with Art. 21 GDPR, you have the right to object to the processing of your data at any time on grounds relating to your particular situation. However, we are not always able to comply with this, e.g. if legal provisions oblige us to process data as part of our official duties.
   
• Withdrawal of your consent
  If we rely on your consent as the legal basis for processing your personal data, you can withdraw that consent at any time.
   

Exercising your rights

To revoke your consent to the use of data, to assert a right to information or the correction, blocking or deletion of your data, or to exercise the other rights of data subject mentioned above, please contact:

FTI Touristik GmbH
Att: Data Protection Officer
Landsberger Straße 88
D-80339 Munich, Germany
Email: datenschutz@fti.de
 

Right to lodge a complaint

If you believe that we have not complied with data protection regulations when processing your data, you can lodge a complaint with a supervisory authority. The supervisory authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.

8. How we protect personal data

To ensure the security of the data transmitted to us, we use TLS encryption. You can recognize such encrypted connections by the prefix https:// in the page link in the address bar of your browser.

Data that you transmit to our website - for example during enquiries or logins - cannot be read by third parties due to SSL encryption.

Recognizing that threats can arise and change at any time, we regularly review and update our security measures and infrastructure to mitigate operational risk and keep our security requirements up to date.

9. Changes to this privacy notice

This document is subject to periodic revision or supplementation.

Munich, 26. April 2024