Data Protection Declaration of the Leipzig Tourismus und Marketing (LTM) GmbH

Leipzig Tourismus und Marketing GmbH (LTM GmbH) thanks you for your interest in our company. Protecting your personal data is important to us. In accordance with Articles 12, 13 and 21 of the General Data Protection Regulation (GDPR), the following information explains how LTM GmbH handles your data.

Personal data is individual information regarding the personal or material circumstances of an identified or identifiable natural person. Pursuant to Art. 4 (1) GDPR, personal data is “any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.”

Part A: Information on how LTM GmbH handles personal data

Part B: Further information on the handling of personal data on the LTM leipzig.travel website

Part A: Information on how LTM GmbH handles personal data

I. Controller

Leipzig Tourismus und Marketing GmbH

Augustusplatz 9

04109 Leipzig, Germany

Tel. +49 341 7104-260

Fax +49 341 7104-271

info@ltm-leipzig.de

II. Data Protection Officer

Leipzig Tourismus und Marketing GmbH

Data Protection Officer Thomas Köhn

Augustusplatz 9

04109 Leipzig, Germany

Tel. +49 341 7104-320

Fax +49 341 7104-301

datenschutz@ltm-leipzig.de

III. Purpose and legal bases for data processing at LTM GmbH

LTM GmbH processes personal data in accordance with the provisions of the General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG) and other applicable data protection regulations where required by law.

The specific data processed, and the manner in which this data is used, depends largely on the services requested or agreed in each case. Further details or additional information on the purposes of the data processing can be found in the contract documents, agreements, forms, declarations of consent and/or other available information (e.g. when using the leipzig.travel website, terms and conditions of travel for packages offered by LTM GmbH).

1. Processing on the basis of your consent in accordance with Art. 6 (1) a) GDPR

Your personal data can be processed for specific purposes (e.g. use of your e-mail address for marketing purposes) if you have given your consent. You can generally withdraw this consent at any time. This also applies to the withdrawal of any consent granted to LTM GmbH before the GDPR entered into force, that is, before 25 May 2018. You will be informed of the purposes of the processing and the consequences of withdrawing your consent or refusing to give your consent in each individual case in the corresponding text on the consent form.

As a general rule, this notice of withdrawal will only have effect for the future. Any processing carried out before consent is withdrawn is not affected by the withdrawal and remains lawful.

2. Processing in order to fulfil a contract or take steps prior to entering into a contract in accordance with Art. 6 (1) b) GDPR

Personal data is processed in order to perform contracts between you and LTM GmbH and to fulfil your orders as well as to take steps and action prior to entering into a contract, for example with prospective customers. The purpose of processing this data is, in particular, to provide tourist services and to deliver products as per your orders and particular requirements, including the services, measures and activities necessary to do so. This mainly includes:

contract-related communication with you, the verification of orders, other agreements and transactions and for quality control by means of appropriate documentation, goodwill measures, measures to control and optimise business processes as well as the fulfilment of general duties of care, control and supervision by affiliated companies (e.g. parent company),
statistical evaluations for company management, cost recording and controlling, reporting, internal and external communication, managing emergencies, accounting and tax assessment of operational services, risk management, assertion of legal claims and defence in the case of legal disputes,
ensuring IT security (including system and plausibility tests) and general security, including building and plant security, safeguarding and exercising the right to enforce house rules, guaranteeing the integrity, authenticity and availability of data, preventing and investigating criminal offences; monitoring by supervisory boards or supervisory authorities (e. g. audits).

3. Purposes for the fulfilment of legal requirements according to Art. Art. 6 (1) c) GDPR or in the public interest under Art. 6 (1) e) GDPR

Just like any other actor in the economy, LTM GmbH is subject to a number of legal obligations. These are primarily statutory requirements (e.g. trade and tax laws, but also, where applicable, regulatory or other requirements imposed by the authorities). The purposes of the processing may also include identity and age checks, the prevention of fraud and money laundering, the prevention, combating and investigation of terrorist financing and criminal offences posing a financial risk, cross-checks with European and international anti-terror lists, compliance with monitoring and reporting obligations under tax law, the archiving of data for the purposes of data protection and data security as well as audits by tax authorities and other government agencies. In addition, it may be necessary to disclose personal data in the context of judicial measures or measures by the authorities for the purposes of collecting evidence, criminal prosecution or the enforcement of civil law claims.

4. Processing for the purposes of a legitimate interest on the part of LTM GmbH or third parties in accordance with Art. 6 (1) f) GDPR

Above and beyond the actual fulfilment of a contract or steps taken prior to entering into a contract, LTM GmbH may process your data where this is necessary to protect its own legitimate interests or those of third parties, in particular for the following purposes:

advertising and market and opinion research provided that you have not objected to the use of your data
obtaining information and exchanging data with credit agencies, insofar as this exceeds LTM GmbH’s financial risk
the review and optimisation of processes for requirements analyses
the further development of products and services as well as existing processes and systems
the disclosure of personal data for the purpose of a due diligence check in the course of company sale negotiations
cross-checks with European and international anti-terrorist lists, insofar as this exceeds the statutory obligations
enriching LTM data, e.g. by using or researching publicly available data
market analysis or statistical evaluations
benchmarking
asserting legal claims and defence in the event of legal disputes that are not directly related to the contractual relationship
the restricted processing of data if deletion is not possible or only possible with disproportionate effort due to the particular type of storage
the development of scoring systems or automated decision-making processes
the prevention and investigation of criminal offences, insofar as this is not solely for compliance with statutory requirements
building and plant security, insofar as this goes beyond the general duties of care
internal and external investigations, safety reviews
the possible monitoring or recording of telephone conversations for quality control and training purposes
preserving and maintaining certifications of a private-law or official nature
safeguarding and exercising the right to enforce house rules by means of appropriate measures to protect the customers and employees of LTM GmbH as well as to secure evidence in the event of criminal offences and the prevention of such offences.

IV. The categories of data processed by LTM GmbH where the data is not received directly from you, and the origin of this data

Where it is necessary for LTM GmbH to provide its services, LTM GmbH processes personal data lawfully obtained from other companies or other third parties (e.g. address publishers, credit agencies). In addition, LTM GmbH processes personal data that has been lawfully obtained, received or acquired from publicly accessible sources (such as telephone directories, the press, Internet and other media, commercial registers, association registers, civil registers, records of debtors, land registers) where the processing of this data is lawful.

Relevant categories of personal data to which this may relate can include in particular:

personal data (name, date of birth, place of birth, nationality, marital status, occupation/branch of trade and comparable data)
contact details (address, e-mail address, telephone number and comparable data)
address details (civil register data and comparable data)
payment confirmation/confirmation of cover for bank and credit cards
information about your financial situation (creditworthiness data including scoring, and data for assessing the commercial risk)
customer history
Data on your use of the electronic information and communication services offered by LTM GmbH (e.g. time of access to the LTM website, clicked pages/links of LTM GmbH or entries and comparable data, newsletter),
video and photographic data.

V. Recipients or categories of recipients of your data

Within LTM GmbH, your data is forwarded to those in-house departments that need this data for compliance with contractual and statutory obligations, or in order to enforce and implement the legitimate interests of LTM GmbH.

LTM GmbH also shares your personal data – to the extent permitted or prescribed by law – with other recipients that provide services on behalf of LTM GmbH. LTM GmbH limits the disclosure of your personal data to the necessary minimum. Some LTM service providers receive your personal data in the role of external processors and are, as such, strictly bound to the instructions of LTM GmbH concerning the handling of your personal data.

Your data is forwarded to external parties only:

in connection with the processing of a contract
on the basis of the legitimate interest of LTM GmbH or the third party for the purposes set out under Section III. / 4 (e.g. to government agencies, credit agencies, collection agencies, solicitors, courts of law, appraisers, companies belonging to the group, boards and supervisory authorities)
for the purposes of compliance with statutory requirements where LTM GmbH is obliged to provide information about, report or disclose data or where the disclosure of data is in the public interest (see Section III. / 3)
where external service providers process data on behalf of LTM GmbH as processors or parties assuming certain functions (e.g. external data centres, support and maintenance of IT applications, archiving, document processing, call centre services, compliance services, controlling, data screening for anti-money laundering purposes, data validation or
plausibility checks, data destruction, purchasing/procurement, customer management, lettershops, marketing, media technology, research, risk monitoring, invoicing, telephony, website management, auditing services, credit institutions, printing companies or data disposal companies, courier services, logistics)
where you have given LTM GmbH your consent to transmit data to third parties

VI. Period for which your data is stored

LTM GmbH processes and stores your data for the duration of the respective business relationship. This also includes steps taken prior to entering into a contract (pre-contractual legal relationship) and the administration of the contract.

In addition, LTM GmbH is subject to various storage and documentation obligations, which result from the German Commercial Code (HGB) and the German Fiscal Code (AO), among others. The periods and deadlines for retention and/or documentation stipulated under this legislation are up to ten years after the end of the commercial relationship or the pre-contractual legal relationship.

In addition, specific statutory provisions may require longer retention periods such as, for example, the preservation of evidence in connection with statutory limitation regulations. In accordance with Sections 195 ff. of the German Civil Code (BGB), the standard limitation period is three years, but limitation periods of up to 30 years may apply.

If the data is no longer required to meet contractual or statutory obligations and rights, it is deleted unless the further processing of the data – for a limited period – is necessary to fulfil the purposes listed under Section III. / 4 due to an overriding legitimate interest. Such an overriding legitimate interest exists, for example, if the deletion of the data is not possible or only possible with disproportionate effort due to the particular type of storage, and processing for other purposes using appropriate technical and organisational measures is excluded.

VII. Transferring data to third countries and international organisations

Data is transmitted to sites in countries outside the European Union (EU) or the European Economic Area (EEA) (known as third countries) where necessary to perform a contract with you or to fulfil an order that you have placed, where prescribed by law (e.g. reporting obligations under tax law), where it is in the legitimate interest of LTM GmbH or a third party, or where you have given LTM GmbH your consent to do so.

In such cases, your data may also be processed in a third country in connection with the involvement of service providers for order processing. If no decision has been issued by the European Commission regarding the existence of an adequate level of data protection in the respective country, LTM GmbH warrants that your rights and freedoms will be adequately protected and safeguarded in accordance with EU data protection requirements through appropriate contractual agreements. LTM GmbH will provide you with detailed information on request.

VIII. Your data protection rights as a data subject

Provided the statutory conditions are met, you as the data subject are entitled to assert the following rights against LTM GmbH:

Right of access: Under Art. 15 GDPR, you have the right, at any time, to obtain from LTM GmbH confirmation as to whether or not personal data relating to you is processed by LTM GmbH. Where this is the case, you also have the right of access to this personal data and certain other information under Art. 15 GDPR (including the purposes of processing, the categories of personal data, the categories of recipients, the envisaged storage period, the source of the data, the use of automated decision-making and, where data is transferred to a third country, the appropriate safeguards) and to obtain a copy of your data (with potential limitations pursuant to Section 34 BDSG).

Right to rectification: Under Art. 16 GDPR, you have the right to request that LTM GmbH rectifies (corrects) any stored data relating to you that is inaccurate or incomplete.

Right to erasure: Under the provisions of Art. 17 GDPR, you have the right, at any time, to request that LTM GmbH erases the personal data relating to you without undue delay. The right to erasure does not apply in certain cases, for example where the processing of personal data is necessary for the exercise of the right of freedom of expression and information, for compliance with a legal obligation to which LTM GmbH is subject (e.g. statutory retention duties) or for the establishment, exercise or defence of legal claims.

Right to restriction of the processing: Under the provisions of Art. 18 GDPR, you have the right to request that LTM GmbH restrict the processing of your personal data.

Right to data portability: Under the provisions of Art. 20 GDPR, you have the right to receive the personal data relating to you and provided to LTM GmbH by you in a structured, commonly used and machine-readable format.

Right to withdraw consent: You have the right to withdraw consent to the processing of your personal data at any time with future effect.

Right to object: Under the provisions of Art. 21 GDPR, you have the right to object to the processing of your personal data. This will have the consequence that LTM GmbH is obliged to cease processing your personal data. The right of objection exists only within the limits provided in Art. 21 GDPR. In addition, the interests of LTM GmbH may conflict with ceasing the processing, meaning that LTM GmbH may have the right to continue processing your personal data despite your objection.

Right to lodge a complaint with a supervisory authority: Under the provisions of Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State in which you live or work or in which the alleged infringement took place, if you are of the opinion that the processing of personal data relating to you infringes the GDPR. The right to lodge a complaint does not prejudice any other administrative or legal remedy.

The competent supervisory authority for LTM GmbH is:

The Data Protection Officer for Saxony

Devrientstraße 5

01067 Dresden, Germany

Tel.: +49 (0)351/8547 1101

Fax: +49 (0)351/8547 1109

Website: www.datenschutz.sachsen.de

E-mail: saechsdsb@slt.sachsen.de

However, LTM GmbH recommends that you always send any complaints to our company data protection officer first.

Where possible, your requests to exercise your rights should be sent in writing to the address stated in Section I above or addressed directly to LTM GmbH’s Data Protection Officer.

IX. Scope of your obligations to provide data

In principle, you are not obliged to provide your personal data to LTM GmbH. However, if you refuse to do so, LTM GmbH will not be able to respond to your enquiries or enter into a contract with you, and you will not be able to use the LTM website. Where LTM GmbH does not necessarily require personal data for the above processing purposes, this is indicated by “where applicable” or another symbol. This means that any information of this kind is provided voluntarily.

X. Automated decision-making / profiling in accordance with Art. 22 GDPR

LTM GmbH does not apply any automated decision-making or profiling (automated analysis of your personal circumstances).

XI. Information about your right to object under Art. 21 GDPR

1. You have the right to object at any time to the processing of your data that is carried out pursuant to Art. 6 (1) e) GDPR (data processing in the public interest) or Art. 6 (1) f) GDPR (data processing on the basis of a balancing of interests), to lodge an objection if there are reasons for doing so which arise from your particular situation. This also applies to any profiling based on these provisions within the meaning of Art. 4 (4) GDPR.

If you object, LTM GmbH will no longer process your personal data unless it can demonstrate compelling legitimate reasons for the processing which override your interests, rights and freedoms, or unless the processing is necessary for the establishment, exercise or defence of legal claims.

2. LTM GmbH also processes your personal data in individual cases for direct marketing purposes. If you do not wish to receive any marketing, you have the right to object to this at any time; this also applies to profiling to the extent that it is related to this direct marketing. LTM GmbH will note this objection for the future.

Where you object to the processing of data for direct marketing purposes, LTM GmbH will no longer process your data for these purposes.

3. No special requirements apply to the format of objections. Objections should be preferably addressed to:

Leipzig Tourismus und Marketing GmbH

Augustusplatz 9

04109 Leipzig, Deutschland

Tel: +49 341 7104 260 Tel. +49 341 7104-260

Fax +49 341 7104-271

info@ltm-leipzig.de

XII. Amendments

LTM GmbH reserves the right to amend this Data Protection Policy at any time. Any changes will be published in the amended Data Protection Policy on the LTM leipzig.travel website. Unless otherwise stipulated, these amendments will take immediate effect. Please review this Data Protection Policy on a regular basis so that you are aware of any changes to the previous version.

This data protection declaration is valid as of 19 May 2020.

Part B: Further information on the handling of personal data on the LTM leipzig.travel website

I. Controller

Leipzig Tourismus und Marketing GmbH

Augustusplatz 9

04109 Leipzig, Germany

Tel. +49 341 7104-260

Fax +49 341 7104-271

info@ltm-leipzig.de

II. Data Protection Officer

Leipzig Tourismus und Marketing GmbH

Data Protection Officer Thomas Köhn

Augustusplatz 9

04109 Leipzig, Germany

Tel. +49 341 7104-320

Fax +49 341 7104-301

datenschutz@ltm-leipzig.de

III. Purposes and legal bases for data processing on the leipzig.travel website

1. Use of the website for informational purposes

You can visit the LTM website without providing any personal details. If you use the LTM website for purely informational purposes, LTM GmbH does not process any personal data other than the data transmitted by your browser that allows you to visit the website and information transmitted to LTM GmbH via cookies that enable a statistical analysis of how the LTM website is used.

a. Technical availability of the website

In order to ensure the technical availability of the website, it is necessary for LTM GmbH to process certain automatically transmitted information relating to you so that your browser is able to display the website and you are able to use it. This information is automatically collected and stored in server log files each time the LTM website is accessed. This information relates to the computer system of the requesting computer. The following information is collected:

IP address (Internet protocol address) of the requesting computer
the website from which you were forwarded to the LTM website (referrer)
the page(s) of the LTM website that you visit
the date and duration of your visit
browser type and settings
operating system

LTM GmbH also uses cookies that allow you to use the website. Cookies are text files that are stored in the Internet browser or stored by the Internet browser on your computer system when you access a website. A cookie contains a characteristic string that serves as a unique identifier for your browser the next time that the website is accessed. LTM GmbH uses these cookies solely for the purpose of allowing you to use the website including its technical features. Some functions of the LTM website are not available without the use of cookies.

The scope of the use of cookies by LTM GmbH is set out below:

The LTM website uses transient cookies, which are temporary. In particular, these include session cookies. These store a so-called session ID, with which different browser requests can be assigned to the shared session. This allows your browser to be recognised when you return to the website. The session cookies are deleted when you close your browser.
LTM GmbH also uses persistent cookies (time-limited use). These cookies save certain settings that are then available to you again the next time you visit the website. Your language setting can be logged for 24 hours, for example. These cookies are automatically deleted after a specified period, which may vary depending on the cookie. You can delete the cookies at any time in your browser’s security settings

The information collected by LTM GmbH via the above cookies will not be used to create user profiles or to evaluate your browsing habits.

LTM GmbH processes your personal data in order to ensure the technical availability of the LTM website on the following legal bases:

to fulfil a contract or take steps prior to entering into a contract in accordance with Art. 6 (1) b) GDPR, if you visit the LTM website to obtain information about the services of LTM GmbH and
to safeguard the legitimate interests of LTM GmbH pursuant to Art. 6 (1) f GDPR, in order to be able to make the website technically available to you. The legitimate interest of LTM GmbH lies in being able to provide you with an appealing, fully functioning and user-friendly website and in adopting measures to protect the LTM website from cyber risks and to prevent third parties from being exposed to cyber risks by the LTM website.

b. Statistical analysis of the use of the LTM website and reach extension

In order to prepare a statistical analysis of how the LTM website is used, LTM GmbH uses Google Analytics, which also involves the use of cookies to enable an analysis of your browsing habits. In this way, LTM GmbH can improve the quality of the LTM website and its content. LTM GmbH receives information on how the website is used and can use this to continually optimise the LTM website.

LTM GmbH processes your personal data for the purpose of preparing a statistical analysis of use of the LTM website on the following legal basis:

Your consent in accordance with Art. 6 (1) a) GDPR.

Google Analytics

LTM GmbH uses Google Analytics, a web analysis service provided by Google Inc., USA, on the LTM website. Google Analytics uses so-called "cookies", which are text files stored on your computer, to enable an analysis of how you use the website. The information generated by the cookies about your use of the LTM website is generally sent to a Google server in the USA and stored there. If IP anonymisation is activated on the LTM website, your IP address will first be truncated by Google within the Member States of the European Union or other countries that are party to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. Google will use this information on behalf of LTM GmbH to evaluate your use of the website, to compile reports on website activities and to provide other services to the website operator relating to website usage and Internet usage. The IP address transmitted within the context of Google Analytics by your browser will not be associated with any other data held by Google.

LTM GmbH uses Google Analytics with the extension “_anonymizeIp()” on the LTM website. This means that IP addresses are only processed in truncated form, meaning that the user cannot be directly identified.

LTM GmbH uses Google Analytics only with your consent. You can withdraw a consent that you have previously given by:

preventing cookies from being stored by changing the settings of your browser software accordingly; however, please note that, if you do so, you may not be able to make full use of all of the features of the LTM website,
downloading and installing the browser plug-in available at the following link: https://tools.google.com/dlpage/gaoptout?hl=en or
clicking this link to prevent Google Analytics from collecting your data on the LTM website in future. This sets an opt-out cookie in your browser. Please note that you will have to activate the opt-out cookie in all of the browsers used on all of your devices and you may also have to reactivate them if you delete all of the cookies in a browser.

For more information about the terms of service for Google Analytics and data protection in this context, please visit https://www.google.de/intl/de/policies/.

Google Analytics remarketing

The LTM website uses the Google Analytics remarketing feature in conjunction with the cross-device features of Google AdWords. This is provided by Google Inc., USA.

This feature makes it possible to link the advertising target groups generated by Google Analytics remarketing with the cross-device features of Google AdWords. This allows personalised advertising tailored to your interests and based on your previous usage and browsing habits on one device (e.g. your mobile phone) to be displayed on any of your other devices (e.g. a tablet or PC).

Provided you have given your consent, Google will link your web and app browser history with your Google account for this purpose. This means that the same personalised advertising can be shown on any device that you use to log in to your Google account.

To support this feature, Google Analytics collects users’ Google-authenticated IDs and temporarily links them to our Google Analytics data. This enables us to define and create target groups for cross-device advertising.

You can permanently object to cross-device remarketing/targeting by disabling personalised advertising in your Google account. To do so, follow this link: www.google.com/settings/ads/onweb/.

The data collected in your Google account will only be aggregated with your consent, which you can give to, or withdraw from, Google (Art. 6 (1) a) GDPR). In the case of data collection operations that are not associated with your Google account (for example, because you do not have a Google account or have objected to your data being aggregated), data is collected on the basis of Art. 6 (1) f) GDPR. The fact that LTM GmbH, as the website operator, has an interest in the anonymised analysis of website visitors for advertising purposes constitutes the legitimate interest.

More information and the data protection provisions can be found in Google’s Privacy Policy at policies.google.com/technologies/ads.

Google Maps

LTM GmbH uses Google Maps, provided by Google Inc., USA, on the LTM website via an API in order to display interactive maps and provide directions.

In order to use the functions of Google Maps, it is necessary to store your IP address. This information is generally transmitted to a Google server in the USA and stored there. The provider of this website has no influence over this data transfer.

To increase the protection of your data when visiting the LTM website, a layer is added to Google Maps apps. You will be asked for your consent for Google Maps content to be integrated into the page accessed by you. Please note that you can also withdraw your consent by deleting the ‘cc_canshowgmap’ cookie in your cookie settings. You are also advised that Google’s Privacy Policy applies when using Google Maps.

The feature is only available if you have agreed to accept cookies.

Google Maps is used in order to make the LTM website more appealing and to make it easy to find the locations displayed on the website. This constitutes a legitimate interest within the meaning of Art. 6 (1) f) GDPR.

More information on how user data is handled can be found in Google’s Privacy Policy: policies.google.com/privacy.

Facebook remarketing

LTM GmbH uses the Custom Audiences remarketing feature, provided by Facebook Inc., USA, on the LTM website.

This allows website users to receive targeted, interest-based advertising when visiting the social network Facebook.

The Facebook remarketing tag has been implemented in the LTM website for this purpose. Each time the website is accessed, a direct connection is established to the Facebook servers via this tag. This tag transmits information on the LTM pages you have visited to the Facebook server. Facebook links this information to your personal Facebook account. When you log on to Facebook, you will then receive personalised, interest-based Facebook ads.

The processing is carried out on the basis of Art. 6 (1) f) GDPR based on the legitimate interest in the above-mentioned purpose.

You have the right, for reasons arising from your particular situation, to object at any time to the processing of your personal data based on Art. 6 (1) f) GDPR. To do so, simply disable the Custom Audiences remarketing feature at https://www.facebook.com/settings/?tab=ads#_=_

More detailed information on the collection and use of data by Facebook, your rights in this context and the options for protecting your privacy can be found in Facebook’s Privacy Policy at:

https://www.facebook.com/about/privacy/.

2. Active use of the website

Besides purely informational use of the LTM website, you can also use the website actively to order an LTM product, register for an event, subscribe to the LTM newsletter or contact LTM GmbH. In addition to the processing of your personal data when using the website for purely informational purposes set out above, LTM GmbH also processes further personal data relating to you that LTM GmbH needs in order to process your order or to deal with and respond to your enquiries.

a. User enquiries

In order to deal with and respond to your enquiries to LTM GmbH, for example via the contact form, the POI form, the travel offer enquiry form, the plan-your-own-tour enquiry form or the registration form for the photo archive, or sent to the LTM e-mail address, LTM GmbH processes the personal data relating to you provided in this context. This includes, in all cases, your name and your e-mail address so that we can send you a response, as well as any other information that you send to LTM GmbH on the particular form.

LTM GmbH processes your personal data for the purpose of responding to user enquiries on the following legal basis:

to safeguard the legitimate interests of LTM GmbH pursuant to Art. 6 (1) f) GDPR. The legitimate interest here is in the proper response to customer enquiries.

b. Booking accommodation, tours and experiences, Welcome Cards and ordering informational material

LTM GmbH has integrated the online booking systems of external service providers to handle bookings for accommodation, tours and experiences, and Welcome Cards, and the ordering of informational material. As soon as you click one of the

»Find Hotel« or »Find Holiday Accommodation« buttons, or
visit the Tours and Experiences section and click the »Book Now« button, or
visit the Leipzig Card and Leipzig Regio Card pages and click the button for one of these cards, or
visit the tourist information page and click the »City Maps and Information Material« button

you will leave the LTM server and be forwarded to an online booking system of an external service provider. The service provider processes the personal data entered here to handle the booking/order.

The service provider handling an accommodation booking or a tours and experiences booking forwards the processed personal data to the relevant hotel or tours and experiences provider. The processing is carried out on the basis of Art. 6 (1) b) GDPR to fulfil a contract or take steps prior to entering into a contract.

The personal data collected when booking Welcome Cards and ordering informational material is forwarded to LTM GmbH for the purposes of handling the order process or the order and payment process. This also constitutes the legitimate interest of LTM GmbH in accordance with Art. 6 (1) b) GDPR. The data is deleted by LTM GmbH as soon as it is no longer required for the stated purposes or where the relevant statutory requirements no longer apply.

You are not required to provide data either by law or by contract. There is no obligation to provide personal data. If you object to the processing of your data, you will not be able to make a booking/place an order with LTM GmbH.

c. Purchases in the regional souvenir shop

In the regional souvenir shop, LTM GmbH allows you to purchase regional souvenirs and tourist literature and maps, such as souvenirs, cycle and walking maps, regional literature, CDs and DVDs, and gift vouchers, provided by third parties (retailers).

In the shop, you can place individual items from the product range in the shopping basket. All items and quantities are saved in the shopping basket. To make ordering easier for you, LTM GmbH also saves any orders that have not yet been completed so that you can finalise them on your next visit.

After you place your order, LTM GmbH acts as an intermediary and forwards it on your behalf to the retailer of regional souvenirs, tourist literature or maps that you selected during the order process. In the process, in addition to the data already collected during the registration process (first and last name, contact details - address, where applicable telephone number, e-mail address, etc.), and an alternative delivery address, where applicable, the following data is collected:

item(s) from the product range
number of items
prices, (net/gross) cost of shipping
the name of the retailer of regional souvenirs, tourist literature or maps that is to provide the items to you

The retailer of regional souvenirs, tourist literature or maps processes the personal data for the purpose of fulfilling the purchase, payment and delivery transaction. Your data is processed for the above purpose on the following legal basis:

to fulfil a contract or take steps prior to entering into a contract in accordance with Art. 6 (1) b) GDPR.

Your data is processed for the above purpose on the following legal basis:

to fulfil a contract or take steps prior to entering into a contract in accordance with Art. Art. 6 (1) b) GDPR to the extent that you visit the website to find out about the services offered by LTM GmbH, and to place orders and for statistical evaluations,
to safeguard the legitimate interests of LTM GmbH pursuant to Art. 6 (1) f GDPR, in order to be able to make the website technically available to you. The legitimate interest of LTM GmbH lies in being able to provide you with an appealing, fully functioning and user-friendly website.

d. Wish lists

LTM GmbH also processes your personal data to enable you to use a wish list. This means that you can gather and download information that is of interest to you, or alternatively, LTM GmbH will send you this information by e-mail upon request. Your IP address, details of the information in which you are interested and, where applicable, your contact details are processed in this case.

LTM GmbH processes your personal data on the following legal bases:

to fulfil a contract or take steps prior to entering into a contract in accordance with Art. 6 (1) b) GDPR,
to safeguard the legitimate interests pursuant to Art. 6 (1) f) GDPR to enable LTM GmbH to collate and provide you with interesting information

The legitimate interest of LTM GmbH lies in being able to provide you with an appealing service and to enable you personally to tailor this service to your own needs.

e. Compliance with statutory regulations

LTM GmbH also processes your personal data in order to meet other statutory obligations that apply to LTM GmbH in connection with the handling of the booking/order. These include, in particular, retention duties under commercial, trade or tax law.

LTM GmbH processes your personal data on the following legal bases:

to fulfil a legal obligation to which LTM GmbH is subject pursuant to Art. 6 (1) c) GDPR in connection with commercial, trade or tax law, insofar as LTM GmbH is obliged to record and store your data.

f. Legal enforcement

LTM GmbH also processes your personal data to enable it to assert its own rights and enforce its own legal claims. In addition, LTM GmbH processes your personal data to defend the company against legal claims. Finally, LTM GmbH processes your personal data to the extent necessary for the prevention and prosecution of criminal offences.

LTM GmbH processes your personal data for this purpose on the following legal bases:

to safeguard the legitimate interests of LTM GmbH pursuant to Art. 6 (1) f) GDPR, insofar as LTM GmbH is able to assert legal claims or defend itself in the event of legal disputes, or where this enables criminal offences to be prevented or investigated.

g. Advertising purposes such as newsletters, surveys, etc.

With your consent, LTM GmbH uses your data for advertising purposes, such as sending LTM newsletters or information about current offers, events, etc., in Leipzig and Leipzig Region. LTM GmbH processes mandatory information such as your e-mail address, but also information that you provide voluntarily. LTM GmbH uses this voluntary information to constantly improve your information experience and make it more user-friendly for you, to be able to personalise future communications sent to you, to analyse your preferences and to inform you about products that are best suited to your needs and to make advertising more useful and interesting for you. You can cancel the notifications at any time by clicking on the link provided in the newsletter for this purpose and following the instructions.

LTM GmbH uses a newsletter service provider to send you its newsletters. This service provider enables LTM to collect information, such as the time the newsletter was opened, information about your e-mail client and device, your click behaviour and the topics that you viewed. LTM GmbH uses this information in pseudonymised form only. By analysing and evaluating this information, LTM GmbH is able to make technical and content-related improvements to the LTM newsletter and its offerings so that it can send you personalised advertising.

The analysis and evaluation of this information helps prevent LTM GmbH from sending you random advertising. Instead, you will be sent advertising, for example newsletters, product recommendations or invitations by e-mail or post, that relates to your areas of interest. To this end, LTM GmbH also monitors which advertising e-mails you open to avoid sending you unnecessary e-mails. Where you have given your e-mail address to LTM GmbH in connection with the purchase of goods or services, this can be used in future by LTM GmbH to send you newsletters. In this case, the newsletter will only be used for the direct marketing of similar LTM goods or services.

LTM GmbH also uses your contact details with your consent for marketing purposes where you order advertising brochures or other material, register for events or take part in surveys.

LTM GmbH processes your data in order to send newsletters and personalise communications on the following legal bases:

in accordance with Art. 6 (1) a) GDPR where you have given LTM GmbH your consent via the double opt-in process, 6 Abs. 1 lit. a DSGVO,
to safeguard the legitimate interests of LTM GmbH in accordance with Art. 6 (1) f) GDPR in conjunction with Section 7 (3) UWG (German Act against Unfair Competition) where you have given LTM GmbH your e-mail address in connection with the purchase of goods or services or where LTM GmbH sends you personalised advertising. 6 Abs. 1 lit. f DSGVO i.V.m. § 7 Abs. 3 UWG. The legitimate interest of LTM GmbH is based on its economic interests, such as conducting advertising activities and targeting advertising to specific target groups.

h. Use of data for e-mail marketing and your right to object

If LTM GmbH uses your e-mail address in connection with the conclusion of a contract and the provision of LTM products and you have not objected to this use, LTM GmbH reserves the right to send you offers for similar products from the LTM range by e-mail on a regular basis. You can object to this use of your e-mail at any time by sending a message to the contact details provided below, or by using a link provided in the marketing e-mail for this purpose, without incurring any costs other than transmission costs charged at the basic rate.

i. Application and use of Teejit - Knowledge Hub

LTM GmbH has integrated services from Teejit on the LTM website. Teejit is a feature for the integration and operation of an online learning platform, which enables tourism knowledge from various areas to be consulted. Data collected in the process is stored on Teejit's servers. This data can be used to develop further training measures or to provide individual users with additional information about tourism. For this purpose, various data on the user's learning progress are visualised within the legal framework.

The data can be used to get in contact with the users of the service and to determine which other services in the field of further education might be relevant for representatives of the potential target groups.

Teejit is a German software company based in Bavaria:

Teejit – Hiller & Stock GbR, Breitenauer Straße 14, 85072 Eichstätt, Tel. 0049 176 23781292

For more information about Teejit's privacy policy, please see the following: https://www.teejit.de/datenschutz

IV. Links and social media links

a. Links

Some sections of the LTM website contain links to the websites of external providers. These websites are subject to their own privacy policies. LTM GmbH is not responsible for the operation of these websites or for their handling of data. If you send information to or through such third-party sites, you should review the privacy statements of those sites before you provide them with information that may be personally identifiable.

b. Social media links

Links to services such as Facebook, Instagram, YouTube, Twitter and Google+ are integrated in the LTM website. You will be forwarded to the website of the respective provider after clicking the link; this means that user information is only transmitted to the respective provider at this stage. Information on how your personal data is handled when using the websites of other providers can be found in the privacy policies of these providers.

V. Recipients or categories of recipients of your data

Within LTM GmbH, your data is forwarded to those in-house departments that need this data for compliance with contractual and statutory obligations, or in order to enforce and implement the legitimate interests of LTM GmbH. LTM GmbH also shares your personal data – to the extent permitted or prescribed by law – with other recipients that perform services relating to the LTM website on behalf of LTM GmbH. LTM GmbH limits the disclosure of your personal data to the necessary minimum required, in particular, the minimum required to process your order/booking. Some LTM service providers receive your personal data in the role of external processors and are, as such, strictly bound to the instructions of LTM GmbH concerning the handling of your personal data.

The categories of recipients of your personal data are listed below:

external service providers that handle bookings for accommodation, tours and experiences, and Welcome Cards, as well as the ordering of informational material and the sending of newsletters
retailers of regional souvenirs, tourist literature or maps
payment service providers and banks where payments are processed
logistics companies in order to deliver goods to you
debt collection agencies and legal advisors where LTM GmbH asserts claims
IT service providers that manage and host the LTM website
other categories of recipients where applicable

VI. Storage period

Use of the website for informational purposes

If you use the LTM website for purely informational purposes, LTM GmbH stores your personal data on the servers solely for the duration of your visit to the LTM website. Your personal data is deleted immediately after you leave the LTM website.

Any cookies installed by LTM GmbH are also usually deleted after you leave the LTM website. However, this does not apply to persistent cookies (including cookies used by Google Analytics), which are automatically deleted after a specified period of time. This may vary depending on the cookie - the maximum storage period is one year (see Section III. / 1. / a. or b.).

You also have the option of deleting installed cookies yourself at any time (see Section III /1. / a. or b.).

Active use of the website

If you use the website actively, LTM GmbH stores your personal data initially for the time that we need to respond to your enquiry or for the duration of the business relationship. This also includes steps taken prior to entering into a contract (pre-contractual legal relationship) and the administration of the contract.

In addition, LTM GmbH also stores your personal data until the limitation period for legal claims from the relationship with you has expired, in order to use it as evidence if necessary. The limitation period is usually between 12 and 36 months, but it can be up to 30 years.

Upon expiry of the limitation period, LTM GmbH will delete your personal data unless it is subject to a statutory retention period, for example, under the German Commercial Code (HGB, Sections 238, 257 (4)) or the German Fiscal Code (AO, Section 147 (3) and (4)). These retention periods can be between two and ten years.

VII. Transferring data to third countries

LTM GmbH transmits your truncated IP address to the USA when using Google tools. The data is transmitted on the basis of the Commission Implementing Decision (EU) 2016/1250 of 12 July 2016 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the EU-US Privacy Shield.

In all other cases, LTM GmbH does not transmit your personal data to countries outside the EU or the EEA or to international organisations.

VIII. Your data protection rights as a data subject

Provided the statutory conditions are met, you as the data subject are entitled to assert the following rights against LTM GmbH:

Right of access: Under Art 15 GDPR, you have the right, at any time, to obtain from LTM GmbH confirmation as to whether or not personal data relating to you is processed by LTM GmbH. Should this be the case, you have the right of access to this personal data and certain other information under Art. 15 GDPR (including the purposes of processing, the categories of personal data, the categories of recipients, the envisaged storage period, the source of the data, the use of automated decision-making and, where data is transferred to a third country, the appropriate safeguards) and to obtain a copy of your data (subject to possible limitations pursuant to Section 34 BDSG).

Right to rectification: Under Art. 16 GDPR, you have the right to request that LTM GmbH rectifies (corrects) any stored data relating to you that is inaccurate or incomplete.

Right to erasure: Under the provisions of Art. 17 GDPR, you have the right, at any time, to request that LTM GmbH erases the personal data relating to you without undue delay. The right to erasure does not apply in certain cases, for example where the processing of personal data is necessary for the exercise of the right of freedom of expression and information, for compliance with a legal obligation to which LTM GmbH is subject (e.g. statutory retention duties) or for the establishment, exercise or defence of legal claims.

Right to restriction of the processing: Under the provisions of Art. 18 GDPR, you have the right to request that LTM GmbH restrict the processing of your personal data.

Right to data portability: Under the provisions of Art. 20 GDPR, you have the right to receive the personal data relating to you and provided to LTM GmbH by you in a structured, commonly used and machine-readable format.

Right to withdraw consent: You have the right to withdraw consent to the processing of your personal data at any time with future effect.

Right to object: Under the provisions of Art. 21 GDPR, you have the right to object to the processing of your personal data. This will have the consequence that LTM GmbH is obliged to cease processing your personal data. The right of objection exists only within the limits provided in Art. 21 GDPR. In addition, the interests of LTM GmbH may conflict with ceasing the processing, meaning that LTM GmbH may have the right to continue processing your personal data despite your objection.

Right to lodge a complaint with a supervisory authority: Under the provisions of Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State in which you live or work or in which the alleged infringement took place, if you are of the opinion that the processing of personal data relating to you infringes the GDPR. The right to lodge a complaint does not prejudice any other administrative or legal remedy.

The competent supervisory authority for LTM GmbH is:

The Data Protection Officer for Saxony

Devrientstraße 5

01067 Dresden, Germany

Tel.: +49 (0)351/8547 1101

Fax: +49 (0)351/8547 1109

Website: www.datenschutz.sachsen.de

E-mail: saechsdsb@slt.sachsen.de

However, LTM GmbH recommends that you always send any complaints to our company data protection officer first.

Where possible, your requests to exercise your rights should be sent in writing to the address stated in Section I above or addressed directly to LTM GmbH’s Data Protection Officer.

IX. Scope of your obligations to provide data

In principle, you are not obliged to provide your personal data to LTM GmbH. However, if you refuse to do so, LTM GmbH will not be able to respond to your enquiries or enter into a contract with you, and you will not be able to use the LTM website. Where LTM GmbH does not necessarily require personal data for the above processing purposes, this is indicated by “where applicable” or another symbol. This means that any information of this kind is provided voluntarily.

X. Automated decision-making / profiling in accordance with Art. 22 GDPR

LTM GmbH does not apply any automated decision-making or profiling (automated analysis of your personal circumstances).

XI. Information about your right to object under Art. 21 GDPR

1. You have the right to object at any time to the processing of your data that is carried out pursuant to Art. 6 ( 1) e) GDPR (data processing in the public interest) or Art. 6 (1) f) GDPR (data processing on the basis of a balancing of interests), to lodge an objection if there are reasons for doing so which arise from your particular situation. This also applies to any profiling based on these provisions within the meaning of Art. 4 (4) GDPR.

If you object, LTM GmbH will no longer process your personal data unless it can demonstrate compelling legitimate reasons for the processing which override your interests, rights and freedoms, or unless the processing is necessary for the establishment, exercise or defence of legal claims.

2. LTM GmbH also processes your personal data in individual cases for direct marketing purposes. If you do not wish to receive any marketing, you have the right to object to this at any time; this also applies to profiling to the extent that it is related to this direct marketing. LTM GmbH will note this objection for the future.

Where you object to the processing of data for direct marketing purposes, LTM GmbH will no longer process your data for these purposes.

3. No special requirements apply to the format of objections. Objections should be preferably addressed to:

Leipzig Tourismus und Marketing GmbH

Augustusplatz 9

04109 Leipzig, Deutschland

Tel: +49 341 7104-260

Fax +49 341 7104-271

info@ltm-leipzig.de

XII. Copyright

The content and works on the LTM website compiled by LTM GmbH are subject to German copyright law. The copying, editing, distribution or any form of use of the content outside the limits of copyright law requires the written consent of the respective author or creator. Downloading or copying the LTM website is permitted only for personal, non-commercial use. Third-party copyrights are respected insofar as the contents of this site were not created by the operator. In particular, third-party content is identified as such. Should you nevertheless become aware of any copyright infringement, LTM GmbH requests that you notify us accordingly. Should any infringement come to our attention, LTM GmbH will remove such content immediately.

XIII. Changes

LTM GmbH reserves the right to amend this Data Protection Policy at any time. Any changes will be published in the amended Data Protection Policy on the LTM leipzig.travel website. Unless otherwise stipulated, these amendments will take immediate effect. Please review this Data Protection Policy on a regular basis so that you are aware of any changes to the previous version.

This data protection declaration is valid as of 19 May 2020.