search and book flights
Spot-Group > Privacy Policy >

Privacy Policy

Privacy policy

1.   Name and contact details of the controller responsible for the processing and of our data protection officer

This data protection information applies for data processing by:

Controller:

Spot Reisen GmbH (hereinafter: Spot Reisen GmbH),
Bödekerstraße 78
30161 Hanover, Germany
E-mail:    ina.lindhorst@spotreisen.com Phone: +49 (0)511 36 42 42 710
Fax: +49 (0)511 123 57091

You can also contact Spot Reisen GmbH’s company data protection officer at the above address, c/o Mr Michael Krüger, or via
datenschutzbeauftragter@spotreisen.com.

2.   Collection and storage of personal data as well as the nature and purpose and use thereof

According to the above paragraphs (the following data is collected, processed or used by Spot Reisen GmbH:

a) During visits to the website

When using our website www.spotgroup.org, information is automatically sent to our website’s server by the browser used on your end device. This information is temporarily stored in what is known as a log file. The following information is collected without you doing anything and is stored until it is automatically deleted:

  • Date and time of the server query
  • Time zone difference to Greenwich Mean Time (GMT)
  • Content of the request, i.e. the specific website
  • Access status/HTTP status code
  • Data volumes transferred/name of the files
  • If necessary, the page on Spot Reisen GmbH’s website from which the file was requested
  • Type of browser used, language and version of the browser used
  • Operating system and its interface
  • IP address of the requesting computer, abbreviated to the last 3 digits

The data stated is processed by us for the following purposes:

  • To guarantee a smooth connection to the website is established,
  • To guarantee our website can be used easily,
  • To analyse the system’s security and stability, and for any other administrative purposes.

The legal basis for the data processing is Article 6(1)(1)(f) GDPR. Our legitimate interest follows from the data collection purposes listed above. In no case do we use the collected data for the purpose of drawing conclusions about you.

We also use cookies and analysis services during visits to our website. You can find more detailed descriptions of this under Para. 4 and 5 of this privacy policy.

b) Booking individual tourist services

  • Title, first and last name, address, telephone number, mobile phone number (optional) and the registering traveller’s or registering customer’s e-mail address
  • Title, first and last name and date of birth of the respective traveller or participant
  • Non-binding customer preferences (optional)
  • Payment method
  • Payment details
  • IP address, time of the booking (misuse check)
  • Contract and performance information for the booking

c)  Registering for our newsletter

  • E-mail address
  • IP address, time of the registration (misuse check)

Spot Reisen GmbH uses the so-called double opt-in method during the newsletter registration process. This means that after your registration Spot Reisen GmbH will send you a confirmation e-mail to the e-mail address provided, in which Spot Reisen GmbH asks you to confirm that you wish to be sent the newsletter. If this confirmation is not given within 24 hours, your registration is automatically deleted. If you confirm your registration to the newsletter within the time period, Spot Reisen GmbH will store your e-mail address until you unsubscribe from the newsletter. This storage serves the sole purpose of being able to send you the newsletter. During the registration and confirmation process, Spot Reisen GmbH also stores your IP address and the time of registration and confirmation in order to prevent misuse of your personal data.

If you have explicitly given your consent according to Article 6(1)(1)(a) GDPR, we will use your e-mail address to regularly send you our newsletter.  All you need to do is enter an email address in order to receive the newsletter.

You can subscribe at any time, for example via a link at the end of each newsletter. Alternatively, you can also ask to unsubscribe at any time by sending an e-mail to datenschutzbeauftragter@spotreisen.com .

 d) Using our contact form

  • First and last name
  • Telephone number (optional)
  • Booking / case number (optional)
  • E-mail address
  • Content of the message
  • IP address, time of sending (misuse check)

e) Contacting us via e-mail

  • E-mail address
  • Content of the e-mail
  • Name and address, if disclosed in the context of the e-mail

f) Contacting us via telephone

  • Name
  • Telephone number
  • Content of your query
  • E-mail address (optional)

For queries of any nature, we give you the option of contacting us via a form provided on our website. If you use this, you will be required to provide a valid e-mail address so that we know where the query has come from and are able to respond. Further details may be freely given.

The data processing for the purpose of contact with us is performed in accordance with Article 6(1)(1)(a) GDPR based on your voluntarily granted consent.

The personal data collected by us in the use of the contact form will be automatically deleted after completion of the request made by you.

3. Disclosure of data

No transfer of your personal data to third parties shall take place other than for the following purposes.

We only share your personal data with third parties when:

  • You have explicitly given your consent according to Art. 6(1)(1)(a) GDPR,
  • This is necessary for asserting, exercising or defending legal claims in accordance with Article 6(1)(1)(f)GDPR and there is no reason to believe that you have an overriding, legitimate interest for your data to not be passed on,
  • Sharing your data in accordance with Article 6(1)(1)(c) is necessary for compliance with a legal obligation, and
  • this is legally permissible and in accordance with Article 6(1)(1)(b) GDPR is necessary for the performance of contract with you.
  1. 4. Data processing for advertising purposes

The following information relates to the processing of personal data for advertising purposes. The GDPR confirms such data processing as possible in principle and as a legitimate interest based on Article 6(1)(f). There are no strict principles for the length of time for which data can be stored for advertising purposes and it focuses on the question whether the storage is necessary for advertising. At Spot Reisen GmbH, we pursue the principle of deleting data for advertising purposes after 90 days. As in the case with your objection, please see Para. 4.3 for more information,

4.1.  Spot Reisen GmbH’s and third-party advertising purposes

If you have concluded a contract with us, we will treat you as existing customers. In this case, we process your postal contact details without the existence of specific consent in order to provide you with information about new products and services in this way. We process your e-mail address to provide you with information for similar products without the existence of specific consent.

4.2.  Advertising suited to your interests    

So that you only receive information which you have an assumed interest in, we categorise and supplement your customer profile with additional information. We use both statistical and personal information about you for this (for example, basic data of your customer profile). The aim is to provide you only with adverts targeted to your actual or assumed needs and to not burden you with pointless advertising.

4.3.  Right of objection      

You may object to data processing for the aforementioned purposes at any time, free of charge, for the individual communication channel and with future effect. An e-mail or a letter via post to the contact details stated under 1. shall be sufficient for this.

If you file an objection, the contact address concerned shall be blocked from additional commercial data processing. We point out that in exceptional cases, you may still be temporarily sent advertising material after we have received your objection. This is technically due to the necessary lead time on adverts and does not mean that we are not implementing your objection. Thank you for your understanding.

5. Cookies

We use cookies on our website. These are small files which are automatically produced by your browser and are stored on your end device (laptop, tablet, smartphone, etc.) when you visit our site. Cookies do not damage your end device, they do not contain any viruses, Trojan horses or other malware.

Information is stored in the cookie which is connected to the specific end device used. However, this does not mean that we receive direct knowledge of your identity.

The use of cookies serves to make our offer more attractive for you to use. So we use so-called session cookies to recognise that you have already visited individual pages of our website. These are automatically deleted after leaving our site.

To optimise the user-friendliness of the website we also use temporary cookies that are stored on your device for a specific period of time. If you visit our site again in order to take advantage of our services, it is automatically recognised that you have already visited and which entries and settings you had so that you do not have to enter these again.

We also use cookies to capture statistics regarding the use of our website and for the purpose of optimising our offer for you (see Para. 5). These cookies allow us to automatically recognise when you visit our site again. These cookies are automatically deleted after a defined time period.

The data processed by cookies is necessary for the purposes mentioned to safeguard our legitimate interests as well as those of third parties in accordance with Article 6(1)(1)(f) GDPR.

Most browsers accept cookies automatically. However, you can configure your browser in such a way that no cookies are stored on your computer or a message always appears before a new cookie is created. Completely deactivating cookies, however, may mean that you are unable to use all of our website’s functions.

6. Analysis tools

a) Tracking tools

The following tracking measures used by us are implemented on the basis of Article 6(1)(1)(f) GDPR. By using the following tracking measures, we want to ensure that the design of our website is appropriate to your needs and its continuous optimisation. We also use tracking measures to capture statistics regarding the use of our website and for the purpose of optimising our offer for you. These interests shall be deemed as legitimate in the meaning of the aforementioned regulation.

The respective data processing purposes and data categories shall be taken from the corresponding tracking tools.

aa) Google Analytics1

For the purpose of designing our website appropriate to your needs and its continuous optimisation, we use Google Analytics, a service operated by Google Inc. (https://www.google.de/intl/de/about/) (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; hereinafter ‘Google’). In this context, anonymised user profiles are created and cookies (see Para. 4) used. The information generated by the cookie regarding your use of this website, such as

  • Browser type / version,
  • Operating system used,
  • The referrer’s URL (previously visited page),
  • Host name of your computer (IP address),
  • Time of server request,

is usually transferred to a Google server in the USA, where it is stored. The information is used for the purpose of analysing your use of the website, compiling reports on website activities and providing us with other services linked to website use and internet use for the purposes of market research and needs-based design of this website. This information will also be passed on to third parties if required by law or where third parties process these data on behalf of Google. On no account will Google link your IP address to other Google data. The IP addresses are anonymised so that an assignment is not possible (IP masking). You can prevent the installation of cookies via the corresponding setting in your browser software; however, in this case you may not be able to completely utilise all functions of the website.

You can also prevent collection of the data (including your IP address) generated by the cookies and related to your use of the website by Google as well as the processing of this data by Google by downloading and installing the browser add-on (https:// tools.google.com/dlpage/gaoptout?hl=de).

As an alternative to the browser add-on, especially for browsers on mobile devices, you can also prevent the data collection by Google Analytics by clicking on this link. An opt-out cookie is installed which prevents the collection of your information when you visit this website in the future. The opt-out cookie is only valid in this browser and only for our website and is stored on your device. If you delete cookies in your browser, you must reset the opt-out cookie.

Additional information on data protection in the context of Google Analytics can be found in Google Analytics Help (https://support.google.com/analytics/answer/ 6004245?hl=de).

ab) Google AdWords Conversion Tracking

We also use Google Conversion Tracking to capture statistics regarding the use of our website and for the purpose of optimising our offer for you. A cookie (see Paragraph 4) is placed on your computer by Google AdWords for this purpose if you have reached our website via a Google Ad.

These cookies lose their effectiveness after 30 days and cannot be used for personal identification. If the user visits certain pages on the AdWords customer’s website and the cookie has not yet expired, the customer and Google are able to recognise that the user has clicked on the advert and has been forwarded to this page.

Every Google AdWords customer receives a different cookie. Cookies therefore cannot be traced via the websites of AdWords customers. The information that is gathered with the help of conversion cookies serves to produce conversion statistics for AdWords customers who have opted for conversion tracking. As a result, the customers are informed about the total number of users who have clicked on their advert and been forwarded to a site with a conversion tracking tag. However, they do not receive any information with which the users could be personally identified.

If you do not want to participate in the tracking process, you can object to the necessary placement of a cookie for this – via the browser setting which deactivates the automatic placement of cookies. You can also deactivate cookies for conversion tracking by adjusting the settings in your browser so that cookies from the domain ‘www.googleadservices.com’ are blocked. You can find information about Google’s data privacy regarding conversion tracking here (https://services.google.com/sitestats/de.html).

ac)    AWStats analysis tool

AWStats is also used for web analysis and analysis of log files. The free web analysis application is installed directly on to the web server, i.e. the data is stored in a data centre in Germany and data is not transferred abroad. Statistical analysis is only used for the server log files which are logged on the server during a visit to the website. Therefore, allocation to an individual person is not possible.

7. Social media plug-ins

On the basis of Article 6(1)(1)(f) GDPR, we use social media plug-ins for the social networks Facebook, Twitter and Instagram on our website in order to promote our company on these networks. The underlying commercial purpose shall be deemed as a legitimate interest in the meaning of the GDPR. Responsibility for an operation which is compliant with data protection shall be guaranteed by the respective provider. We integrate this plug-in by using the so-called two-click method to best protect visitors to our website.

a) Facebook

Facebook’s social media plug-ins are used on our website to make its use more personal. We use the ‘LIKE’ or the ‘SHARE’ button for this. This is offered by Facebook.

When you visit one of our webpages that contains a plug-in like this, your browser connects directly to the Facebook servers. The content of the plug-in is then transferred by Facebook directly to your browser and integrated by this into the website.

By integrating plug-ins, the Facebook receives information that your browser has requested the corresponding page of our website, even if you do not have a Facebook profile or are not logged in to Facebook. This information (including your IP address) is transferred directly from your browser to Facebook’s server in the USA and stored there.

For example, if you are logged into Facebook, Facebook can immediately assign your visit to our website to your Facebook profile. If you interact with the plug-ins, for example, you click the ‘LIKE’ or ‘SHARE’ button, the corresponding information is sent directly to Facebook’s server and stored there. The information is also published on Facebook and displayed to your Facebook friends.

Facebook may use this information for the purposes of advertising, market research and the needs-based design of Facebook webpages. To do this, Facebook creates user, interest and relationship profiles, for example, to analyse your use of our website with respect to the adverts integrated into your Facebook, to inform other Facebook users about your activities and to provide additional services connected to using Facebook.

If you do not want Facebook to assign the data collected from our website to your Facebook profile, you should log out of Facebook before visiting our website.

The purpose and scope of the data collection, and the further processing and use of the data by Facebook and your rights and configuration options concerning this to protect your privacy, can be found in Facebook’s privacy notices (https://www.facebook.com/about/privacy/).

b) Twitter

Plug-ins from the messaging network from Twitter Inc. (Twitter) are integrated into our website. You can recognise Twitter plug-ins (Tweet button) from the Twitter logo on our site. You can find an overview of Tweet buttons here (https://about.twitter.com/resources/buttons).

When you visit one of our webpages that contains a plug-in like this, your browser connects directly to the Twitter server. Twitter is thereby notified that you have visited our website with your IP address. If you click on the Twitter

‘Tweet button’ whilst logged in to your Twitter account, you can link the content of our pages to your Twitter profile. This allows Twitter to link your visit to our website to your user account. We would like to point out that we as the providers of this website do not have any knowledge of the content of the data transferred or of its use by Twitter.

If you do not want Twitter to be able to link your visit to our website to your Twitter user account, please log out of your Twitter account.

You can find further information about this in Twitter’s privacy statement here (https://twitter.com/privacy).

c)  Instagram

Instagram’s so-called social media plug-ins (‘plug-ins) are used on our website which are operated by Instagram LLC., 1601 Willow Road, Menlo Park, CA 94025, USA (‘Instagram’).

The plug-ins are identified by an Instagram logo, for example an ‘Instagram camera’. When you visit one of our webpages that contains a plug-in like this, your browser connects directly to the Instagram servers. The content of the Instagram plug-in is directly transmitted to your browser and integrated into the webpage. By integrating plug-ins, Instagram receives information that your browser has requested the corresponding page of our website, even if you do not have an Instagram profile or are not logged in to Instagram.

This information (including your IP address) is transferred directly from your browser to Instagram’s server in the USA and stored there. For example, if you are logged in to Instagram, Instagram can immediately assign your visit to our website to your Instagram account. If you interact with the plug-ins, for example, you click the ‘Instagram’ button, the corresponding information is sent directly to Instagram’s server and stored there.

The information is also published on your Instagram account and displayed to your contacts there.

If you do not want Instagram to assign the data collected from our website to your Instagram account, you should log out of Instagram before visiting our website.

You can find further information about this in Instagram’s privacy statement (https://help.instagram.com/155833707900388).

8. Rights of data subjects

You have the right:

  • under Article 15 GDPR to demand information on your personal data processed by us. In particular, you can request information on the purposes of the processing, the category of personal data, the category of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing, or objection, the existence of a right of appeal, the provenance of the data if this data has not been collected by us, as well as the existence of automated decision-making including profiling and, where applicable, meaningful information on the details of this;
  • under Article 16 GDPR to request the immediate rectification or completion of your personal data stored by us;
  • under Article 17 GDPR to request the erasure of your personal data stored by us, unless the processing is necessary for exercising the right to freedom of expression and information, to fulfil a legal obligation, for reasons in the public interest or for the assertion, exercise or defence of legal claims;
  • under Article 18 GDPR the right to demand the restriction of the processing of your personal data insofar as you contest the accuracy of the data; the processing is unlawful,


but you oppose the erasure thereof; and we no longer require the data, but you need this for the assertion, exercise or defence of legal claims or you have objected to the processing pursuant to Article 21 GDPR;

  • under Article 20 GDPR the right to receive the personal data which you have provided to us, in a structured, commonly used and machine-readable format and the right to transmit that data to another controller;
  • under Article 7(3) GDPR to revoke the consent you have given to us at any time. As a result of this we shall no longer be permitted to perform the data processing based on such consent in the future; and
  • under Article 77 GDPR to lodge a complaint with a supervisory authority. For this, you can generally contact the supervisory authority of your usual place of residence or work or of our company head office.

9. Right of objection

Insofar as your personal data is processed on the basis of legitimate interests in accordance with Article 6(1)(1)(f) GDPR, you have the right pursuant to Article 21 GDPR to object to the processing of your personal data if there are grounds relating to your particular situation or you are objecting to direct advertising. In the latter case, you have a general right to object which is implemented by us without need for a particular situation.

If you would like to exercise your right to object, an
e-mail to datenschutzbeauftragter@spotreisen.com is sufficient.

10.   Data security

We use the SSL process (Secure Socket Layer) in connection with the respective highest encryption level which is supported by your browser on our website. This is normally a 256-bit encryption. If your browser does not support 256-bit encryption, we default to 128-bit v3 technology instead. You will know whether an individual website is encrypted by the closed depiction of the key or padlock system in the bottom status bar of your browser.

We operate our own technical and organisational security measures to protect your data from accidental or intentional manipulations, partial or complete loss, destruction or unauthorised access by a third party. Our security measures are continuously improved in line with technological developments.

11.   Updating and amending this privacy policy

This privacy policy is currently valid and was updated May 2018.

It may be necessary to amend this privacy policy due to the further development of the website and online presence or due to amended legal or official provisions. The current privacy policy can be accessed at any time on the website at
https://www.spotgroup.org/datenschutzerklärung and printed out.

12. Data protection and data security declaration

Spot Reisen GmbH undertakes to uphold the aforementioned points on data protection and data security in the ways described.

Hanover, 24 May 2018

Spot Reisen GmbH
Bödekerstr. 78
30161 Hanover
Germany