We are delighted that you have taken an interest in our company. Data protection is a top priority for the management of Holigo GmbH. In principle, it is possible to use the Holigo GmbH website without providing any personal data. However, should a data subject wish to make use of specific services offered by our company via our website, the processing of personal data may be necessary. If the processing of personal data is necessary and there is no legal basis for such processing, we generally seek the consent of the data subject. We want you to know when we store which data and how we use it. As a company governed by private law, we are subject to the provisions of the Federal Data Protection Act (BDSG). We have implemented technical and organisational measures to ensure that data protection regulations are observed both by us and by other external service providers. All personal data collected in this context is collected, processed and used in accordance with the applicable regulations on the protection of personal data, solely for the purposes of contract fulfilment and to safeguard our own legitimate business interests with regard to serving our customers. The disclosure of your personal data to unauthorised third parties outside the company is strictly prohibited. We will only disclose your data to authorities entitled to receive such information if we are obliged to do so by law or by court order. We will not use your data for any purpose to which you have not expressly consented. If you have provided us with personal data, you may have it deleted at any time. Data required for billing, legal and accounting purposes is not affected by any cancellation or deletion. Upon your request, we will inform you in writing, in accordance with applicable law, whether and which personal data relating to you is stored by us. We have summarised the information required under Section 4e of the Federal Data Protection Act (BDSG) in our public procedure directory. The rapid development of the internet means that adjustments to our security and data protection structure are required from time to time. You will be informed of any changes here. The processing of personal data – such as a data subject’s name, address, email address or telephone number – is always carried out in accordance with the General Data Protection Regulation and in compliance with the country-specific data protection regulations applicable to Holigo GmbH. Through this privacy policy, our company aims to inform the public about the nature, scope and purpose of the personal data we collect, use and process. Furthermore, this privacy policy informs data subjects of their rights. As the data controller, Holigo GmbH has implemented numerous technical and organisational measures to ensure the most comprehensive possible protection of the personal data processed via this website. Nevertheless, internet-based data transmissions may, in principle, be subject to security vulnerabilities, meaning that absolute protection cannot be guaranteed. For this reason, any data subject is free to provide us with personal data via alternative means, such as by telephone.

Holigo GmbH’s Privacy Policy is based on the terminology used by the European legislators and regulators when enacting the General Data Protection Regulation (GDPR). Our privacy policy is intended to be easy to read and understand for the general public as well as for our customers and business partners. To ensure this, we would like to explain the terminology used at the outset. In this privacy policy, we use the following terms, amongst others:

The data controller within the meaning of the General Data Protection Regulation, other data protection laws applicable in the Member States of the European Union and other provisions relating to data protection is: Holigo GmbH Düsselstr. 18a 41564 Kaarst Germany

The Holigo GmbH website uses cookies. Cookies are text files that are placed and stored on a computer system via a web browser. By using cookies, Holigo GmbH is able to provide users of this website with more user-friendly services that would not be possible without the use of cookies. Cookies enable us to optimise the information and content on our website to suit the user’s needs. As mentioned above, cookies allow us to recognise users of our website. The purpose of this recognition is to make it easier for users to use our website. For example, a user of a website that uses cookies does not have to re-enter their login details every time they visit the website, as this is handled by the website and the cookie stored on the user’s computer system. Another example is the shopping basket cookie in an online shop. The online shop uses a cookie to remember the items a customer has placed in their virtual shopping basket. The data subject may prevent our website from setting cookies at any time by adjusting the settings of their web browser accordingly, thereby permanently objecting to the setting of cookies. Furthermore, cookies that have already been set can be deleted at any time via a web browser or other software programmes. This is possible in all common web browsers. If the data subject disables the setting of cookies in the web browser they are using, it may not be possible to make full use of all the functions of our website.

Personal data is collected when you provide it to us of your own accord, e.g. when registering, by filling in forms, by sending emails or, in particular, when booking a flight. Our staff are bound by a duty of confidentiality regarding personal data. We do not sell addresses to third parties. Holigo GmbH (Holigo) uses personal data collected solely via the online platform only for the purpose of establishing or amending a contractual relationship. If you have subscribed to our email newsletter, your data will be collected, processed and used for the purpose of sending it to you. For the purposes of advertising, market research or tailoring our services to your needs, your data will only be used with your consent or in pseudonymised form, provided you have not objected to this. Personal data (name, address, telephone number, email address, date of birth, etc. and payment-related data such as credit card numbers or bank details) which you provide to us in connection with booking a flight are collected, processed and used by Holigo within the scope of the contractual purpose of the sale, arrangement and provision of flights and associated services. Where necessary for this purpose and permitted by law, your data will be transferred to third parties (e.g. tour operators, airlines, travel insurance providers). All airlines are legally obliged to disclose flight and booking data for all passengers travelling to and from the USA to the US Customs and Border Protection. This data is required for security reasons and is treated confidentially. If we need to pass on data to third parties to fulfil your bookings or other orders, or because we are legally obliged to do so, this may include third parties in countries outside the European Union, some of which may not have comparable data protection regulations. We assure you that all personal and payment-related data is treated as strictly confidential by us. Holigo undertakes to use the data collected, processed and stored during registration and when using Holigo’s services and promotions (e.g. bookings, newsletter subscriptions, prize draws) solely for our own customer service purposes and for the purpose of fulfilling contracts concluded with Holigo’s involvement. By ‘own’ purposes, we mean, on the one hand, customer service purposes – i.e. information on flight schedules, for example – and, on the other hand, information relating to the contract, such as notifications of significant changes on our website. This also includes customer information, such as details of interesting offers, travel-related products and services. The details you provide when you sign up for our email newsletter are collected and stored solely for the purpose of sending Holigo information and for market research purposes. Your data will not be passed on to third parties. Whenever your data is used for advertising purposes, we will inform you of your right to opt out. You can unsubscribe from the mailing list at any time via a link in the newsletter or on our website. In this case, your data will be deleted immediately.

The Holigo GmbH website collects a range of general data and information each time a data subject or an automated system accesses the website. This general data and information is stored in the server’s log files. The following may be recorded: (1) the types and versions of browsers used, (2) the operating system used by the accessing system, (3) the website from which an accessing system reaches our website (known as the referrer), (4) the sub-pages on our website accessed via an accessing system, (5) the date and time of access to the website, (6) an Internet Protocol address (IP address), (7) the internet service provider of the accessing system; and (8) other similar data and information used for security purposes in the event of attacks on our information technology systems. When using this general data and information, Holigo GmbH does not draw any conclusions about the data subject. Rather, this information is required in order to (1) deliver the content of our website correctly, (2) to optimise the content of our website and the advertising displayed on it, (3) to ensure the long-term functionality of our IT systems and the technology underpinning our website, and (4) to provide law enforcement authorities with the information necessary for criminal prosecution in the event of a cyber-attack. This data and information, collected anonymously, is therefore analysed by Holigo GmbH both for statistical purposes and with the aim of enhancing data protection and data security within our company, ultimately to ensure an optimal level of protection for the personal data we process. The anonymous data from the server log files is stored separately from any personal data provided by a data subject.

The data subject has the option of registering on the data controller’s website by providing personal data. The personal data transmitted to the data controller in the process is determined by the relevant input form used for registration. The personal data entered by the data subject is collected and stored exclusively for internal use by the data controller and for its own purposes. The data controller may arrange for the data to be passed on to one or more data processors, such as a parcel delivery service, who will also use the personal data exclusively for internal purposes attributable to the data controller. Furthermore, when registering on the data controller’s website, the IP address assigned by the data subject’s internet service provider (ISP), as well as the date and time of registration, are stored. This data is stored on the basis that this is the only way to prevent the misuse of our services, and that, where necessary, this data enables criminal offences to be investigated. In this respect, the storage of this data is necessary to safeguard the data controller. As a general rule, this data is not disclosed to third parties, unless there is a legal obligation to do so or the disclosure serves the purposes of criminal prosecution. The data subject’s registration, involving the voluntary provision of personal data, enables the data controller to offer the data subject content or services which, by their very nature, can only be made available to registered users. Registered users are free to amend the personal data provided during registration at any time or to have it completely deleted from the data controller’s database. The data controller shall, upon request, provide any data subject with information at any time regarding which personal data relating to that data subject is stored. Furthermore, the data controller shall rectify or erase personal data at the request or upon notification by the data subject, provided that this does not conflict with any statutory retention obligations. All staff members of the data controller are available to the data subject as points of contact in this regard.

On the Holigo GmbH website, users are given the opportunity to subscribe to our company’s newsletter. The personal data transmitted to the data controller when subscribing to the newsletter is specified in the form provided for this purpose. Holigo GmbH informs its customers and business partners at regular intervals about the company’s offers via a newsletter. In principle, a data subject can only receive our company’s newsletter if (1) the data subject has a valid email address and (2) the data subject registers to receive the newsletter. For legal reasons, a confirmation email is sent using the double opt-in procedure to the email address provided by a data subject when registering for the newsletter for the first time. This confirmation email serves to verify whether the holder of the email address, as the data subject, has authorised the receipt of the newsletter. When registering for the newsletter, we also store the IP address assigned by the Internet Service Provider (ISP) to the computer system used by the data subject at the time of registration, as well as the date and time of registration. The collection of this data is necessary to be able to trace any (potential) misuse of a data subject’s email address at a later date and therefore serves to provide legal protection for the data controller. The personal data collected as part of a newsletter subscription is used exclusively for sending our newsletter. Furthermore, newsletter subscribers may be informed by email where this is necessary for the operation of the newsletter service or for registration purposes, as might be the case with changes to the newsletter content or alterations to the technical conditions. No personal data collected as part of the newsletter service is passed on to third parties. The data subject may cancel their subscription to our newsletter at any time. Consent to the storage of personal data, which the data subject has given us for the purpose of sending the newsletter, may be withdrawn at any time. A link for this purpose is provided in every newsletter. Furthermore, it is possible to unsubscribe from the newsletter at any time directly on the data controller’s website or to notify the data controller of this in another way.

Holigo GmbH’s newsletters contain what are known as web beacons. A web beacon is a tiny graphic embedded in emails sent in HTML format to enable log file recording and analysis. This allows for a statistical evaluation of the success or failure of online marketing campaigns. Using the embedded web beacon, Holigo GmbH can determine whether and when an email has been opened by a data subject and which links contained in the email have been clicked by the data subject. Such personal data collected via the tracking pixels contained in the newsletters is stored and analysed by the data controller in order to optimise the distribution of the newsletter and to tailor the content of future newsletters even more closely to the data subject’s interests. This personal data is not disclosed to third parties. Data subjects are entitled at any time to withdraw the separate declaration of consent given in this regard via the double opt-in procedure. Following such a withdrawal, this personal data will be deleted by the data controller. Holigo GmbH automatically interprets unsubscribing from the newsletter as a withdrawal of consent.

In accordance with statutory provisions, the Holigo GmbH website contains information that enables users to contact our company quickly by electronic means and to communicate directly with us; this also includes a general electronic mail address (e-mail address). Where a data subject contacts the data controller by email or via a contact form, the personal data transmitted by the data subject is stored automatically. Such personal data, provided voluntarily by a data subject to the data controller, is stored for the purposes of processing the enquiry or contacting the data subject. This personal data is not disclosed to third parties.

The data controller shall process and store the data subject’s personal data only for the period necessary to fulfil the purpose of storage, or insofar as this is provided for by the European legislator (in directives and regulations) or by another legislator in laws or regulations to which the data controller is subject. If the purpose of storage ceases to apply or if a retention period prescribed by the European legislative and regulatory authorities or another competent legislator expires, the personal data shall be routinely blocked or erased in accordance with statutory provisions.

The data controller collects and processes applicants’ personal data for the purpose of handling the application process. Processing may also be carried out electronically. This is particularly the case where an applicant submits the relevant application documents to the data controller electronically, for example by email or via a web form on the website. If the data controller enters into an employment contract with an applicant, the data provided will be stored for the purpose of managing the employment relationship in accordance with the relevant legal provisions. If the data controller does not enter into an employment contract with the applicant, the application documents will be automatically deleted two months after notification of the rejection decision, provided that no other legitimate interests of the data controller preclude such deletion. Other legitimate interests in this context include, for example, the burden of proof in proceedings under the General Equal Treatment Act (AGG).

The data controller has integrated the Google Analytics component (with anonymisation function) into this website. Google Analytics is a web analytics service. Web analytics refers to the collection, gathering and analysis of data relating to the behaviour of website visitors. Among other things, a web analytics service records data on which website a data subject came from (known as the ‘referrer’), which sub-pages of the website were accessed, and how often and for how long a sub-page was viewed. Web analytics is predominantly used to optimise a website and to carry out a cost-benefit analysis of online advertising. The operator of the Google Analytics component is Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA. The data controller uses the add-on “_gat._anonymizeIp” for web analytics via Google Analytics. This suffix causes Google to truncate and anonymise the IP address of the data subject’s internet connection when our website is accessed from a Member State of the European Union or from another signatory state to the Agreement on the European Economic Area. The purpose of the Google Analytics component is to analyse visitor traffic on our website. Google uses the data and information collected, amongst other things, to evaluate the use of our website, to compile online reports for us showing activity on our website, and to provide other services related to the use of our website. Google Analytics places a cookie on the data subject’s information technology system. What cookies are has already been explained above. The placement of the cookie enables Google to analyse the use of our website. Each time a user accesses one of the individual pages of this website, which is operated by the data controller and on which a Google Analytics component has been integrated, the web browser on the data subject’s IT system is automatically prompted by the respective Google Analytics component to transmit data to Google for the purposes of online analysis. As part of this technical process, Google obtains personal data, such as the data subject’s IP address, which Google uses, amongst other things, to trace the origin of visitors and clicks and, consequently, to facilitate commission settlements. Personal information, such as the time of access, the location from which access originated and the frequency of the data subject’s visits to our website, is stored by means of a cookie. Each time our website is visited, this personal data – including the IP address of the internet connection used by the data subject – is transmitted to Google in the United States of America. This personal data is stored by Google in the United States of America. Google may, under certain circumstances, pass on this personal data, collected via the technical process, to third parties. As outlined above, the data subject may at any time prevent our website from setting cookies by adjusting the settings of the web browser they are using, thereby permanently objecting to the setting of cookies. Adjusting the settings of the internet browser used in this way would also prevent Google from setting a cookie on the data subject’s IT system. Furthermore, a cookie already set by Google Analytics can be deleted at any time via the internet browser or other software programmes. Furthermore, the data subject has the option to object to the collection of data generated by Google Analytics relating to the use of this website, as well as to the processing of such data by Google, and to prevent this from taking place. To do so, the data subject must download and install a browser add-on from the link https://tools.google.com/dlpage/gaoptout. This browser add-on uses JavaScript to inform Google Analytics that no data or information regarding visits to websites may be transmitted to Google Analytics. Google regards the installation of the browser add-on as an objection. If the data subject’s IT system is subsequently deleted, formatted or reinstalled, the data subject must reinstall the browser add-on in order to deactivate Google Analytics. If the browser add-on is uninstalled or deactivated by the data subject or by another person within their control, it is possible to reinstall or reactivate the browser add-on. Further information and Google’s applicable data protection provisions can be found at https://www.google.de/intl/de/policies/privacy/ and at http://www.google.com/analytics/terms/de.html. Google Analytics is explained in more detail at this link: https://www.google.com/intl/de_de/analytics/.

The data controller has integrated PayPal components into this website. PayPal is an online payment service provider. Payments are processed via so-called PayPal accounts, which are virtual personal or business accounts. PayPal also offers the option of processing virtual payments via credit cards if a user does not have a PayPal account. A PayPal account is managed via an email address, which is why there is no traditional account number. PayPal enables users to make online payments to third parties or to receive payments. PayPal also acts as a trustee and offers buyer protection services. PayPal’s European operating company is PayPal (Europe) S.à.r.l. & Cie. S.C.A., 22–24 Boulevard Royal, 2449 Luxembourg, Luxembourg. If, during the ordering process in our online shop, the data subject selects ‘PayPal’ as the payment method, the data subject’s details are automatically transmitted to PayPal. By selecting this payment option, the data subject consents to the transfer of personal data required for payment processing. The personal data transmitted to PayPal usually comprises first name, surname, address, email address, IP address, telephone number, mobile phone number or other data necessary for payment processing. Personal data relating to the specific order is also required to fulfil the contract of sale. The purpose of transferring the data is to process the payment and prevent fraud. The data controller will transfer personal data to PayPal in particular where there is a legitimate interest in doing so. The personal data exchanged between PayPal and the data controller may be transferred by PayPal to credit reference agencies. The purpose of this transfer is to verify identity and creditworthiness. PayPal may pass on personal data to affiliated companies, service providers or subcontractors where this is necessary to fulfil contractual obligations or where the data is to be processed on its behalf. The data subject has the right to withdraw their consent to the processing of personal data at any time by notifying PayPal. Withdrawal of consent does not affect personal data that must be processed, used or transferred for the purposes of (contractual) payment processing. PayPal’s current privacy policy can be found at https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

The data controller has integrated components from Sofortüberweisung into this website. Sofortüberweisung is a payment service that enables cashless payment for products and services online. Sofortüberweisung utilises a technical process through which the online retailer receives immediate confirmation of payment. This enables a retailer to deliver goods, services or downloads to the customer immediately after the order has been placed. The operating company behind Sofortüberweisung is SOFORT GmbH, Fußbergstraße 1, 82131 Gauting, Germany. If the data subject selects ‘Sofortüberweisung’ as the payment method during the ordering process in our online shop, the data subject’s details are automatically transmitted to Sofortüberweisung. By selecting this payment option, the data subject consents to the transfer of personal data required for payment processing. When completing a purchase via Sofortüberweisung, the buyer transmits the PIN and the TAN to Sofort GmbH. Sofortüberweisung then carries out a bank transfer to the online retailer following a technical check of the account balance and the retrieval of further data to verify that there are sufficient funds in the account. The online retailer is then automatically notified that the financial transaction has been completed. The personal data exchanged via Sofortüberweisung comprises first name, surname, address, email address, IP address, telephone number, mobile phone number or other data necessary for payment processing. The purpose of transmitting this data is to process the payment and prevent fraud. The data controller will also transfer other personal data to Sofortüberweisung where there is a legitimate interest in doing so. The personal data exchanged between Sofortüberweisung and the data controller may be transferred by Sofortüberweisung to credit reference agencies. The purpose of this transfer is to verify identity and creditworthiness. Sofortüberweisung may pass on personal data to affiliated companies, service providers or subcontractors where this is necessary to fulfil contractual obligations or where the data is to be processed on its behalf. The data subject has the right to withdraw their consent to the processing of personal data at any time by notifying Sofortüberweisung. Such a withdrawal does not affect personal data which must be processed, used or transferred for the purposes of (contractual) payment processing. Sofortüberweisung’s current data protection provisions can be accessed at https://www.sofort.com/ger-DE/datenschutzerklaerung-sofort-gmbh/.

Article 6(1)(a) of the GDPR serves as the legal basis for our company’s processing operations where we obtain consent for a specific purpose of processing. If the processing of personal data is necessary for the performance of a contract to which the data subject is a party – as is the case, for example, with processing operations required for the delivery of goods or the provision of other services or consideration – the processing is based on Article 6(1)(b) of the GDPR. The same applies to processing operations necessary for the implementation of pre-contractual measures, such as in cases of enquiries regarding our products or services. Where our company is subject to a legal obligation which necessitates the processing of personal data, such as to fulfil tax obligations, the processing is based on Article 6(1)(c) of the GDPR. In rare cases, the processing of personal data may be necessary to protect the vital interests of the data subject or another natural person. This would be the case, for example, if a visitor were to be injured on our premises and their name, age, health insurance details or other vital information subsequently had to be disclosed to a doctor, a hospital or other third parties. In such cases, the processing would be based on Article 6(1)(d) of the GDPR. Finally, processing operations may be based on Article 6(1)(f) of the GDPR. This legal basis applies to processing operations not covered by any of the aforementioned legal bases, where the processing is necessary to safeguard a legitimate interest of our company or a third party, provided that the interests, fundamental rights and freedoms of the data subject do not take precedence. We are permitted to carry out such processing operations in particular because they have been specifically mentioned by the European legislator. In this regard, the legislator took the view that a legitimate interest could be assumed if the data subject is a customer of the controller (Recital 47, second sentence, of the GDPR).

Where the processing of personal data is based on Article 6(1)(f) of the GDPR, our legitimate interest is the conduct of our business activities for the benefit of the well-being of all our employees and our shareholders.

The criterion for the duration of the storage of personal data is the relevant statutory retention period. Once this period has expired, the relevant data is routinely deleted, provided it is no longer required for the performance of a contract or for entering into a contract.

We would like to inform you that the provision of personal data is, in some cases, required by law (e.g. tax regulations) or may also arise from contractual provisions (e.g. details of the contracting party). In some cases, it may be necessary for a data subject to provide us with personal data in order to conclude a contract, which we must then process. For example, the data subject is obliged to provide us with personal data when our company enters into a contract with them. Failure to provide the personal data would mean that the contract with the data subject could not be concluded. Before providing personal data, the data subject must contact one of our staff members. Our staff member will explain to the data subject, on a case-by-case basis, whether the provision of personal data is required by law or contract, or is necessary for the conclusion of the contract; whether there is an obligation to provide the personal data; and what the consequences of failing to provide the personal data would be.

As a responsible company, we do not use automated decision-making or profiling. This privacy policy was created using the privacy policy generator provided by DGD Deutsche Gesellschaft für Datenschutz GmbH, which acts as an external data protection officer in Hamburg, in cooperation with Christian Solmecke, an IT and data protection lawyer based in Cologne.