1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

M. Michalk Gastro- und Campingservice GmbH
Gartenfelder Str. 29-37
13599 Berlin
Germany
Phone: +49 172 4777445
Email: info@gac-service.de

2. General information on data processing and legal bases

We generally process personal data of our users only insofar as this is necessary to provide a functional website as well as our content and services. The processing is regularly carried out only with the user's consent or where a legal basis permits it.

Depending on the processing, the legal basis is in particular: your consent (Art. 6 (1) (a) GDPR), the performance of a contract or pre-contractual measures (Art. 6 (1) (b) GDPR), compliance with a legal obligation (Art. 6 (1) (c) GDPR) and the safeguarding of our legitimate interests (Art. 6 (1) (f) GDPR). For the storage of information on your device or access to such information, § 25 TDDDG (German Telecommunications Digital Services Data Protection Act) additionally applies.

3. Hosting

We host our website with Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The processing takes place on servers within the European Union. Hetzner processes on our behalf all data necessary to operate and deliver our website.

The legal basis is our legitimate interest in a secure and stable provision of our website pursuant to Art. 6 (1) (f) GDPR; insofar as the access serves the initiation or performance of a contract, additionally Art. 6 (1) (b) GDPR. A data processing agreement pursuant to Art. 28 GDPR has been concluded with the provider.

4. Server log files

Each time our website is accessed, our system automatically collects data and information from the accessing device in so-called server log files. These include in particular the IP address, the date and time of access, the page accessed, the volume of data transferred, the referrer as well as the browser type and operating system. This data serves to deliver the website and to ensure system security and stability.

The legal basis is our legitimate interest in a technically error-free and secure operation of the website pursuant to Art. 6 (1) (f) GDPR. The log files are deleted as soon as they are no longer required for the stated purpose.

5. SSL/TLS encryption

For security reasons and to protect the transmission of confidential content, this website uses SSL or TLS encryption. You can recognise an encrypted connection by the "https://" in your browser's address bar.

6. Cookies and consent management

We use cookies and comparable technologies. Technically necessary cookies are required for the operation of the website. Non-necessary cookies (e.g. for analysis and marketing) are only set after you have given your consent.

To obtain and manage your consent, we use "Cookiebot" provided by Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark. In doing so, your consent data (including a shortened IP address, consent status, the time of consent, browser information and an anonymous key) is processed and stored in order to document your selection and take it into account on your next visit. The processing takes place within the EU.

The legal basis for consent management is the fulfilment of our legal obligation to be able to demonstrate consent pursuant to Art. 6 (1) (c) GDPR as well as our legitimate interest in a legally compliant design pursuant to Art. 6 (1) (f) GDPR. The storage of or access to information on your device takes place on the basis of your consent pursuant to § 25 (1) TDDDG. You can withdraw your consent at any time with effect for the future via the cookie settings.

7. Google Analytics 4

Provided you have given your consent, we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies and similar technologies to analyse your use of the website (including pages accessed, time spent, shortened IP address, device and browser information, approximate location). The analysis serves to evaluate reach and usage behaviour in order to improve our offering.

The legal basis is your consent pursuant to Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TDDDG. You can withdraw your consent at any time with effect for the future via the cookie settings. A transfer to the USA to Google LLC cannot be ruled out; the company is certified under the EU-US Data Privacy Framework, and we additionally base transfers on the standard contractual clauses of the EU Commission.

8. Google Tag Manager

We use Google Tag Manager provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to manage and trigger website tags. The Tag Manager itself does not generally store any personal data in cookies, but controls the loading of further services (e.g. Google Analytics). Tags that require consent are only triggered after you have given your consent.

The legal basis, insofar as services requiring consent are loaded via the Tag Manager, is your consent pursuant to Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TDDDG; otherwise our legitimate interest in an efficient management of the website tags pursuant to Art. 6 (1) (f) GDPR.

9. Google Maps

Provided you have given your consent, we embed maps from the "Google Maps" service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, on our website in order to display interactive maps and facilitate directions. When you access a page with an embedded map, information about your use (in particular your IP address) is transmitted to Google and processed there; cookies may also be set in this context. The map is only loaded after you have given your consent.

The legal basis is your consent pursuant to Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TDDDG. You can withdraw your consent at any time with effect for the future via the cookie settings. A transfer to the USA to Google LLC cannot be ruled out; the company is certified under the EU-US Data Privacy Framework, and we additionally base transfers on the standard contractual clauses of the EU Commission.

10. Contacting us

If you contact us by email, telephone or via our contact form, we process the data you provide (e.g. name, contact details, content of your enquiry) in order to handle your enquiry.

The legal basis, where your enquiry is aimed at the conclusion or performance of a contract, is Art. 6 (1) (b) GDPR; in all other cases our legitimate interest in handling your enquiry pursuant to Art. 6 (1) (f) GDPR. The data is deleted as soon as it is no longer required for the purpose of handling the enquiry and no statutory retention obligations prevent this.

11. Customer account and order processing

You can create a customer account in our shop. In doing so, as well as with each order, we process the required data (in particular name, address, email address, telephone number, order and payment data) in order to manage your account and process your orders.

The legal basis is the performance of the contract pursuant to Art. 6 (1) (b) GDPR. Insofar as commercial and tax law retention obligations exist, we additionally process certain data on the basis of Art. 6 (1) (c) GDPR. You can have an existing customer account deleted at any time.

12. Payment processing

To process payments, we use the payment service provider PayPal (Europe) S.à r.l. et Cie, S.C.A, 22-24 Boulevard Royal, L-2449 Luxembourg. Depending on the payment method selected, the data required for the payment (including name, address, order and payment data, email address) is transmitted to the payment service provider, who processes it under its own responsibility in accordance with its data protection provisions.

The legal basis is the performance of the contract pursuant to Art. 6 (1) (b) GDPR as well as our legitimate interest in secure and smooth payment processing pursuant to Art. 6 (1) (f) GDPR.

13. Shipping and shipping notification

To deliver your order, we pass on the required data (in particular name, delivery address and – insofar as required for delivery or scheduling – email address and/or telephone number) to the respective commissioned shipping or freight forwarding service provider. Depending on the shipment, these are:

• DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn
• General Logistics Systems Germany GmbH & Co. OHG (GLS), GLS Germany-Straße 1-7, 36286 Neuenstein
• DACHSER SE, Thomas-Dachser-Str. 2, 87439 Kempten
• Cargoboard GmbH & Co. KG, Technologiepark 22, 33100 Paderborn
• Cargo International GmbH, Friedrich-Ebert-Straße 22, 78054 Villingen-Schwenningen

Insofar as this is necessary for the performance of the contract or you have given your consent, we transmit your email address and/or telephone number to the shipping service provider so that they can inform you of the shipping status or arrange a delivery date.

The legal basis is the performance of the contract pursuant to Art. 6 (1) (b) GDPR; for the shipping status notification additionally our legitimate interest in transparent delivery pursuant to Art. 6 (1) (f) GDPR or your consent pursuant to Art. 6 (1) (a) GDPR.

14. Customer reviews

After a purchase, we invite you by email to submit a review via the review platform Trustpilot operated by Trustpilot A/S, Pilestræde 58, 1112 Copenhagen, Denmark. For this purpose, we transmit the data required to send the invitation (in particular your email address and an order reference) to the provider. The review you submit is processed and published by Trustpilot.

The legal basis for sending the review invitation is your consent pursuant to Art. 6 (1) (a) GDPR; insofar as the requirements are met, we alternatively base the sending on § 7 (3) of the German Act Against Unfair Competition (UWG) in conjunction with our legitimate interest pursuant to Art. 6 (1) (f) GDPR. You can object to receiving such emails at any time.

15. Recipients and data processing on our behalf

Your personal data is only transferred to third parties within the scope of the purposes set out in this privacy policy. Insofar as we use service providers who process data on our behalf and in accordance with our instructions (e.g. hosting, payment processing, shipping, analysis, consent management), we have concluded data processing agreements pursuant to Art. 28 GDPR with them where required.

16. Transfer to third countries

Insofar as we transfer data to recipients outside the EU or the EEA, this only takes place if an adequate level of data protection exists. We base transfers, in particular to the USA, on an adequacy decision of the EU Commission (e.g. the EU-US Data Privacy Framework, provided the recipient is certified) or on the standard contractual clauses of the EU Commission. You can obtain further information on request via the contact details stated above.

17. Storage period

We process and store your personal data only for as long as is necessary for the respective purposes or insofar as statutory retention periods exist. After the respective period expires or the purpose ceases to apply, the data is routinely deleted or blocked.

18. Your rights as a data subject

With regard to the personal data concerning you, you have the following rights:

• right of access (Art. 15 GDPR)
• right to rectification (Art. 16 GDPR)
• right to erasure (Art. 17 GDPR)
• right to restriction of processing (Art. 18 GDPR)
• right to data portability (Art. 20 GDPR)
• right to withdraw consent given, with effect for the future (Art. 7 (3) GDPR)

To exercise your rights, you can contact us at any time using the contact details stated above.

19. Right to object

Insofar as we process personal data on the basis of our legitimate interests pursuant to Art. 6 (1) (f) GDPR, you have the right to object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR). If your data is processed for the purpose of direct marketing, you have the right to object at any time without giving reasons.

20. Right to lodge a complaint with a supervisory authority

Without prejudice to any other legal remedies, you have the right to lodge a complaint with a data protection supervisory authority if you are of the opinion that the processing of your personal data infringes the GDPR. The supervisory authority responsible for us is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59-61
10555 Berlin
Phone: +49 30 13889-0
Email: mailbox@datenschutz-berlin.de

21. Data security

We take technical and organisational security measures to protect your data against manipulation, loss, destruction and against access by unauthorised persons. Please note that no security measure can guarantee complete protection.

22. Data of children

Our services are not directed at children. We do not knowingly collect personal data from persons under 16 years of age. If, as a parent or legal guardian, you become aware that data of a child has been transmitted to us, please contact us; we will delete the data in question without delay.

23. Currency and amendment of this privacy policy

This privacy policy is currently valid. As our website and offerings develop further, or due to changed statutory or official requirements, it may become necessary to amend this privacy policy.