Introduction
Yes, we also focus on sun, beach and surfing. But we also ensure the protection and security of your data. We want to inform you about all of this here. Not only so that you know what happens to your data, but also so that you know what rights you have. And so that you can give your fully informed consent where this is legally required.
Let's start with the basics. Personal data is all data that has to do with you, e.g. your name, your age, your email address. But also your IP address, because this allows us to identify you personally. In addition to this so-called "personal master data", we collect data on your bookings or orders in our shop, for example, which is necessary for the correct provision of services, data to fulfill our legal obligations such as your consent to receive our Primesurf newsletter or other advertising data and information about the use of our telemedia such as accessing our website or using communication media for voting purposes.
We only store and process data that we have received from you as part of our business relationship or that has been lawfully transmitted to us by third parties.
The processing of this data always requires a legal basis and a defined purpose. Without this, we are not allowed to process the data. This also means: if the purpose for which we processed the data no longer exists, we must delete the data.
In short: we are responsible for your data. Before we process it, we have thought about the purpose, the legal basis and security. "We" specifically means:
Primesurf GmbH
Cannon Hill 20
21423 Winsen (Luhe)
If you have any questions, please send us an email toinfo[at]primesurf.com . Or just talk to us.
As a data subject, you also have various rights that you can assert against us. This includes, in particular, the right to information. If you want to know what data we store about you and for what purpose we process it, contact us and we will provide information as required. If you find that we are storing incorrect data, be it because we have accidentally entered something incorrectly or your address has changed in the meantime or something similar, then we are obliged to correct this. The same applies to the deletion of data: if you find that we are still processing data that we are no longer allowed to process because, for example, the purpose no longer exists, let us know. We will then stop processing the data immediately or delete this data. We will explain everything else in detail below.
Data collection on this website
We collect various data on our website. We would like to explain this to you below.
Technically necessary data processing
We already collect data just by accessing this website. This includes, for example, which browser you use, which operating system and which IP address you access from. This is a technical necessity. Without IP addresses, the Internet would not work. This is the first category of data: everything that is related to the technology of accessing the website and is necessary for this. This also includes the cookies that are necessary for the operation of our website. Cookies are small text files that are stored on your device and contain information. We will encounter them more often.
Our website is operated by Host Europe Web Hosting . This means that our website is hosted on a server under their control. Every time you visit the site, it is stored in a log there. This is for security reasons and is of course in our interest. After all, we want to offer you a website that is as secure, stable and performant as possible. Host Europe stores the following information:
- your IP address
- Date and time of access
- Name and URL of the retrieved file
- the fact that you come from our website
- the browser used and, if applicable, the operating system of your computer, as well as the name of your access provider
We also use Cloudflare Stream and CDN for the same purpose and legal basis. Cloudflare offers the option of saving and streaming videos. And also storing other files. However, since the data is not stored directly on our server (i.e. on Host Europe), the Cloudflare server is called up. This also receives your IP address and the other information mentioned above, which is also generated when you call up our server.
This means that data is transferred to other companies. In addition, we have to store data (in the form of cookies) on your device so that our website functions correctly. These are listed in the consent banner under "Essential". This includes, for example, the language you have selected or the selection you have made in the consent banner.
Data processing after consent
And that brings us to the consent banner. Because in addition to the technically necessary cookies and external calls, there are also services for the use of which we need your consent.
Why do we need your consent? There can be two reasons for this. Firstly, we are not otherwise allowed to access data on your device when it comes to functionalities that are not necessary for you (as a visitor to the site). This includes, for example, storing cookies for marketing purposes. Secondly, we are not allowed to access external services that are classified by the EU as not secure in terms of data protection without your consent. For example, when embedding Google Maps or accessing Google Web Fonts, as the USA is currently considered an unsafe third country for data security.
As you can see from our consent banner, it mainly covers three topics:
- Website analysis (aka Google Analytics)
- Marketing (aka Meta Pixel)
- External calls
Google Analytics
We use Google Analytics 4, a web analysis service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"). This service enables us to find out how you use our website. In addition, Google enriches this data with "demographic characteristics". This allows marketing campaigns to be more targeted. However, only statistical, anonymized information is visible to us. Google Ireland may transfer data to its American parent company.
We therefore need your explicit consent, which you can give (and of course revoke) via the consent banner. In addition, some browsers (depending on the settings) block the calls.
Meta Pixel
Meta Pixel is the same, just not from Google, but from Meta Platforms Ireland Limited, 4 Grand Canal Quare, Dublin 2, Ireland (formerly Facebook). Here, too, it is about analyzing website visits and remarketing based on them. We only use this if you have given us your consent in the consent banner. Please note that Meta probably links all of this information together (including your Facebook profile, if you have one) and uses it for its own purposes ( https://www.facebook.com/about/privacy/ ).
External calls
In some places we have embedded external content on our website. For example, so that you can see directly at our surfing locations whether the weather is suitable for surfing in the next few days. We do not prepare this information ourselves, but have a window on the page that shows you directly to the provider's website. Our goal is for you to find all the information easily on our website so that you can plan your events with the best information possible. Unfortunately, there are legal requirements here too, because we refer you to others and you pass on information to them in the process.
Therefore, you can either allow the individual providers globally in the consent banner, or you will be explicitly asked whether you want to allow this at the individual points where we would embed the content.
Windy.App is a weather app designed specifically for wind and water sports. It is operated by Windy Weather World Inc. We use it on the destination pages to display wind statistics and forecasts.
Windguru provides current wind conditions. It is operated by Ing. Václav Horník, Taussigova 1152, Praha 8, 18200, Czech Republic.
We use IP Live Cam to display live video on some of our destination pages. The website is operated by IPCamLive.com Ltd, Hungary, Infopark, 1117 Budapest Neumann János utca 1/B.
Legitimate interest
As already mentioned: if all of the above legal bases do not apply, but we still process your data, we do so because we have a so-called “legitimate” interest in doing so.
communication
You can contact us via our website. There is a contact form for this and we look forward to receiving any message from you. We will save the message(s) and your email address for as long as we need them to process your request. Of course, you can also request deletion yourself. Just let us know.
At the same time, you can register on the website to receive the Primesurf newsletter to receive exclusive and free information about our destinations and events, current promotions and offers and highlights from the kite world. To send our newsletter, we use Zoho Campaigns, an offer from Zoho Corporation GmbH, Trinkausstr. 7, 40213 Düsseldorf, Germany.
In addition to the ability to create newsletters, Zoho Campaigns provides analysis tools that allow you to make statements about the success of newsletter distribution.
In this context, we partially process your data automatically with the aim of evaluating certain personal aspects (profiling), e.g. evaluation for targeted customer communication, as well as needs-based advertising including market and opinion research.
Booking requests
As you know, we are a network of companies that, for example, operate the different locations.
Therefore, if you want to make bookings via our site, you will be redirected to another website or reach this page via embedded content. You can tell this because the URL of the page begins with "booking". If necessary, you will be redirected to the pages of our partner companies. Here, too, the URL of the page changes because you are then changing the domain (that is the last part of the URL). No data is passed on, we only redirect you to the correct booking pages. Everything else then runs via our partners' website or is described below.
Contractual data processing or pre-contractual data processing
We (and our partners) useBookinglayer as a booking platform. This was developed by a Dutch company called Timtim BV especially for holiday events. The address is: TimTim BV, Stationsweg 23, 9671 AM in Winschoten. This is used to manage the entire booking process. We process this data in order to be able to fulfill the contract with you (your booking).
When organizing competitions, we use personal data that is necessary for conducting the competition, for example for sending prizes.
We save the data you provide when placing an order in our online shop for the purpose of contract processing, sending the order and warranty. Our online shop runs on the online shop software Shopify from the provider of the same name, Shopify Inc., 151 O'Connor Street, Ground floor, Ottawa, ON, K2P 2L8, Canada.
Categories of recipients
In order to fulfil the intended purposes, the data required in each case can be accessed across departments within our company (including across national borders). Contract processors employed by us can also receive data for certain purposes, e.g. for IT services, document destruction and marketing.
Your rights – this time in detail
We have already mentioned this briefly above, but the law requires us to explain your rights regarding data protection in detail. We are happy to do so here. First of all, it should be said that this all sounds very technical - and we have tried not to use legal jargon. Here, as on the water, communication is key. So just talk to us if you have any questions about data protection, comments, or concerns that we can help you with.
Information, deletion and correction
Within the framework of the applicable legal provisions, you have the right at any time to obtain free information about your stored personal data, its origin and recipient and the purpose of data processing and, if applicable, a right to correction or deletion of this data.
Revocation of your consent to data processing
Many data processing operations are only possible with your express consent. You can revoke your consent at any time. From the time of revocation, we may no longer process your data.
Right to object to data processing
That sounds a bit technical: revocation, objection. In the end, in both cases it's about you being able to request that we no longer process data. As described above, in the first case you gave your consent beforehand, in the second case we processed your data on our own initiative - based on legitimate interest - and you are now objecting to this. In principle, you can always contact us if you think that we should no longer process your data - wording or not.
This applies in particular if we send you advertising and you no longer want this.
Right to restriction of processing
There are reasons why you may not want us to continue processing your data. This includes in particular the deletion of this data. This is related, for example, to the rights mentioned above. If we have incorrect data, you can request that we no longer use this data until it is corrected. Or you object to the processing and we have to check whether there are interests that are so important that we continue to process the data anyway. But we can't think of a suitable example right now.
But the classic example here is: you need the data to exercise legal claims. Whether against us or against third parties is irrelevant, but then you could ask us to keep this data for longer than its actual storage period.
Right to lodge a complaint with the competent supervisory authority
In the event of violations of the applicable data protection laws, you have the right to complain to the supervisory authority. For us (Primesurf GmbH) this is the State Commissioner for Data Protection of Lower Saxony.
Obligation to provide data
You only have to provide the personal data that is necessary for the establishment, execution and termination of a contract or that we are legally obliged to collect. If you do not want to provide us with the necessary information and documents, we are not allowed to start or continue the business relationship you have requested.
Changes to our privacy policy
We reserve the right to occasionally adapt this privacy policy so that it always complies with current legal requirements or to implement changes to our services in the privacy policy, e.g. when introducing new services. The new privacy policy will then apply to your next visit.