Privacy Policy

Welcome to our website. We take the protection of your data very seriously. For this reason, we would like to let you know which data from your visit we will use and for which purposes. Should you have any questions on how we handle your personal data, please do not hesitate to contact our Data Protection Officer (contact details are provided at the end of this privacy policy).

I. The organisation responsible

Under the General Data Protection Regulation (GDPR), the entity responsible for the use of your data in the context of this website is:

Hamburg Tourismus GmbH
Wexstraße 7
20355 Hamburg, Germany

II. General information on data processing

1. What are personal data?

The term ‘personal data’ is defined in the General Data Protection Regulation (hereinafter referred to as the “GDPR”). According to this definition, ‘personal data’ means any information relating to an identified or identifiable natural person. This includes details like your name, address, telephone number and date of birth. Information on how you use this website may also be categorised as personal data if it can be used to derive your identity.

2. Scope of the processing of personal data

As a general rule, we process our users’ personal data only if this is required in order to be able to provide a functional website as well as our content and services. Our users’ personal data are regularly processed only after the users have expressed their consent or if processing is permitted by legal provisions.

a) Legal basis for processing personal data

Provided we acquire the consent of the data subject for processing their personal data, the legal basis is defined by Art. 6 para. 1 lit. a of the GDPR.

Art. 6 para. 1 lit. b of the GDPR forms the legal basis for the processing of personal data that is necessary for the performance of a contract to which the data subject is party. This also applies to processing operations that are necessary prior to entering into a contract.
Where the processing of personal data is necessary for compliance with a legal obligation to which our company is subject, the legal basis is defined by Art. 6 para. 1 lit. c of the GDPR.

Art. 6 para. 1 lit. d of the GDPR forms the legal basis in the event that the processing of personal data is necessary in order to protect the vital interests of the data subject or of another natural person.

If processing is necessary for the purposes of the legitimate interests pursued by our company or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, the legal basis is defined by Art. 6 para. 1 lit. f of the GDPR.

b) Data erasure and retention period

The data subject’s personal data shall be erased or blocked if the purpose for which they were stored no longer applies. The data may be stored beyond this time if this was stipulated by European or national legislators in Union regulations, laws or other provisions to which the controller is subject. The data shall also be blocked or erased if a retention period stipulated by the stated standards expires, unless it is necessary to continue storing the data for a contract conclusion or contract performance.

III. Provision of website and creation of log files

1. Description and scope of data processing

The following information is documented when accessing our website:
• Browser type/browser version
• Operating system
• Referrer URL (previously visited website), as well as the pages accessed on our website
• IP address
• Date and time of the server request
• Internet service provider

The data are also stored in our system’s log files. However, these data are not stored together with other personal data from the user.

2. Legal basis of data processing

The legal basis for storing the data and the log files is Art. 6 para. 1 lit. f of the GDPR.

3. Purpose of data processing

The system’s temporary storage of the IP address is necessary to enable the website to be delivered to the user’s computer. For this purpose, the user’s IP address must be stored for the duration of the session. The data are stored in log files to ensure that the website functions. In addition, the data help us to optimise the website and ensure the security of our information technology systems. The data are not evaluated in this context for marketing purposes. Our legitimate interest in data processing also lies in these purposes, in accordance with Art. 6 para. 1 lit. f of the GDPR.

4. Retention period

The data we store shall be erased as soon as they are no longer required for achieving the purpose of their collection. This is the case after no more than seven days. The data may also be stored beyond this period. In this case, the user’s IP address shall be erased or distorted so that the client can no longer be classified.

5. Possibility to object and opt out

Collecting the stated data is essential to be able to operate the website. For this reason, the user shall have no possibility to object.

IV. Use of cookies

1. Description and scope of data processing

Our website uses cookies. Cookies are text files that are stored in the internet browser or by the internet browser on the user’s computer system. When a user accesses a website, a cookie may be stored on his or her operating system. This cookie contains a characteristic string of characters that enable the browser to be unambiguously identified the next time the website is accessed.
We use cookies in order to make our website more user-friendly. Some elements on our website also require the calling browser to be identified after changing pages.

The following data are stored and transmitted in the cookies:
(1) Language settings
(2) Log-in information

On our website, we also use cookies that enable an analysis of the user’s surfing behaviour.
The following data, among others, may be transmitted in this way:
(1) The search terms entered
(2) The frequency of page views
(3) The use of website features

User data collected in this way are pseudonymised by technical means. It is, therefore, no longer possible to assign the data to the respective user. The data are not stored together with other personal data from the user. When accessing our website, a banner is displayed to inform users about the use of cookies for analysis purposes and make reference to this privacy policy. Information is also provided on how to prevent cookies from being stored in the browser settings.

2. Legal basis for data processing

Insofar as we use cookies for analysis or marketing purposes, we process your data on the basis of your consent pursuant to Art. 6 para. 1 sentence 1 lit. a) DSGVO and § 25 (1) TTDSG. For the use of technically necessary cookies, the legal basis is Art. 6 para. 1 sentence 1 lit. f) DSGVO and § 25 para. 2 no. 2 TTDSG (essential cookies). Further processing is carried out in each case in accordance with Art. 6 para. 1 DSGVO.

3. Purpose of data processing

The purpose of using technically necessary cookies is to make it easier for users to use websites. Some features of our website could not be provided without the use of cookies. These features require the browser to be recognised again after a change of page.
We need cookies for the following applications, among others:
(1) Applying language settings
(2) Remembering search terms

The user data collected by the technically necessary cookies are not used to create user profiles. The use of analysis cookies serves the purpose of improving the quality of our website and its content. The analysis cookies enable us to find out how the website is used so that we can continuously optimise our services. Our legitimate interest in processing personal data also lies in these purposes, in accordance with Art. 6 para. 1 lit. f of the GDPR.

4. Period of retention, and possibility to object and opt out

Hamburg Tourismus GmbH offers you the possibility within the framework of a consent management (“Cookie Banner”) to decide according to your specifications about the setting of cookies in the area of our offer. For more information on the individual services, the scope and duration of data storage or to view and manage your consent individually, you can access our consent platform and make your personal settings again:

By changing the settings in your internet browser, you can deactivate or limit the transmission of cookies. Cookies already stored can be erased at any time. This can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to fully use all the website’s features.

V. Matomo

1. Description and scope of data processing

Our website uses the web analytics service Matomo. Matomo is an open source project and is legally represented by its founder Matthieu Aubry. Matomo uses “cookies”, which enable an analysis of the use of the website. For this purpose, the usage information collected in the cookie (including your shortened IP address) is transmitted to our server and stored for usage analysis purposes. Matomo does not transmit any data to servers that are outside of our control. Your IP address is immediately anonymised during this process so that you as a user are not identifiable to us. The information collected about your use of this website is not transferred to third parties.

2. Legal basis for data processing

The legal basis for the use of Matomo is your consent pursuant to Article 6 para. 1 sentence 1 lit. a) GDPR.

3. Purpose of data processing

We use the collected data for statistical analysis of user behaviour for the purpose of optimising the functionality and stability of the website and for marketing purposes.

4. Period of retention, and possibility to object and opt out

The data will be deleted as soon as the purpose of processing has ceased to apply and there is no legal reason to the contrary.

By changing the settings in your Internet browser, you can disable or restrict the transmission of cookies. In addition, you can delete already stored cookies at any time. In this case, however, you may no longer be able to fully use all functions of the website. In addition, you can revoke your consent at any time by adjusting the cookie settings.

Opt-out complete; your visits to this website will not be recorded by the Web Analytics tool. Note that if you clear your cookies, delete the opt-out cookie, or if you change computers or Web browsers, you will need to perform the opt-out procedure again.

You may choose to prevent this website from aggregating and analyzing the actions you take here. Doing so will protect your privacy, but will also prevent the owner from learning from your actions and creating a better experience for you and other users.

You are not opted out. Uncheck this box to opt-out. You are currently opted out. Check this box to opt-in.

The tracking opt-out feature requires cookies to be enabled.

VI. HCB Venuefinder

1. Description and scope of data processing

This site uses the HCB Venuefinder of the agency Elbgoods (Elbgoods GmbH, Alter Wall 69, 20457 Hamburg). When you call up the homepage, your IP address is briefly transmitted to the service provider. It will be deleted every night. This process is technically necessary as the database of locations is located on the Elbgoods GmbH website. The HCB Venuefinder presents locations specially tailored for Hamburg and the metropolitan region, which can be rented for various occasions. These are locations of various kinds. When using the Venuefinder, personal data, such as the user’s IP address, is processed and stored.

2. Legal basis of the data processing

The legal basis for this data processing is your consent pursuant to Art.6 (1) p.1 lit.a DSGVO.

3. Purpose of data processing

On behalf of the provider of this website, Elbgoods GmbH offers the Venuefinder as a tool to enable you to easily search for locations for various occasions. In this respect, the purpose of the data processing is the provision of the offer.

4. Duration of storage

The data will be deleted as soon as the purpose of processing has ceased to apply and there is no legal reason to the contrary.

5. Possibility of opposition and elimination

The collection of the above mentioned data is absolutely necessary for the operation of the website. Consequently, there is no possibility for the user to object.

VII. Two-click solution for the incorporation of YouTube

We have incorporated YouTube components on our website. YouTube is an online video site that allows video publishers to upload video clips free of charge whilst enabling other users to watch, rate and comment on these clips free of charge. YouTube permits the publication of all kinds of videos, which is why it is possible to not only access complete films and TV programmes via the site, but also music videos, trailers and user-generated videos.

The site is provided by YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. YouTube, LLC is a subsidiary of Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.

This website does not embed any YouTube videos directly, thus preventing profile generation by third parties.

In order to nonetheless watch our videos, the user has to firstly click on the preview image. The video can only be watched once the user clicks to acknowledge the notice or logs in. Data will only be transferred at this point.

For more information, please refer to https://www.youtube.com/intl/en/yt/about/and the privacy policy published by YouTube, which can be accessed at https://policies.google.com/privacy?hl=en&gl=de. These pages provide information on the collection, processing and use of personal data by YouTube and Google.

VIII. E-mail contact

1. Description and scope of data processing

You can contact us via the provided e-mail address. In this case, the user’s personal data transmitted in the e-mail will be stored. The data thus provided shall not be forwarded to third parties. Instead, the data will only be used to process the conversation.

2. Legal basis for data processing

The legal basis for processing data transmitted in an e-mail is Art. 6 para. 1 lit. f) of the GDPR. If the aim of the e-mail contact is to conclude a contract, the additional legal basis for the processing is Art. 6 para. 1 lit. b) of the GDPR.

3. Purpose of data processing

Processing the personal data sent by e-mail serves the sole purpose of handling the request. If contact is made by e-mail, the required legitimate interest shall also lie in processing the data.

4. Retention period

The data shall be erased as soon as they are no longer required for achieving the purpose of their collection. This is the case for personal data sent by e-mail when the respective conversation with the user has ended. The conversation is deemed to have ended when the circumstances show that the situation in question has been conclusively clarified.

5. Possibility to object and opt out

Users can withdraw their consent to having their personal data processed at any time. If users contact us by e-mail, they can object to their personal data being stored at any time. In this case, the conversation cannot be continued. All personal data stored during the contact process shall be erased in this case.

IX. Data security

We take technical and organisational security measures to protect your data from accidental or intentional manipulation, loss, destruction or unauthorised access. Our security measures are continuously improved in line with technological developments.

X. Rights of the data subject

We will gladly provide you with information on whether personal data relating to you is being processed; if this is the case, you have right to access this personal data and to the information listed in detail in Art. 15 GDPR. In addition, you have the right to rectification (Art. 16 GDPR), the right to restriction of processing (Art. 18 GDPR), the right to erasure (Art. 17 GDPR) and the right to data portability (Art. 20 GDPR) under the respective legal conditions.

What right do you have in case of data processing based on your legitimate or public interest?
Pursuant to Article 21 (1) GDPR, you have the right to object at any time to the processing of personal data relating to you which is carried out based on Article 6 (1) 1 (e) GDPR (data processing in the public interest) or on the basis of Art. 6 (1) 1 (f) GDPR (data processing for the protection of a legitimate interest) for reasons arising from your particular situation.

You can withdraw your consent to the processing of personal data at any time. Please note that the withdrawl is only effective for the future.
Without limiting these rights and the possibility of seeking any other administrative or judicial remedy, you may at any time exercise your right to submit a complaint to a supervisory authority, in particular in the Member State of your residence, place of work or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes data protection law (Article 77 GDPR).

XI. Amendments to the privacy policy

We reserve the right to change this privacy policy at any time in compliance with the applicable data protection regulations. The current status is February 2023.

XII. Contact details of the Data Protection Officer

If you have any data protection concerns, please do not hesitate to contact our external data protection officer:
For the attention of: external Data Protection Officer of Hamburg Tourismus GmbH
intersoft consulting services AG
Beim Strohhause 17
20097 Hamburg
Phone: +49 (0) 40 790 235 0
E-Mail: datenschutz@hamburg-tourismus.de