Privacy Policy
1. Data protection at a glance
General information
The following information provides a simple overview of what happens to your personal data when you visit our website. Personal data is any information that can be used to identify you personally. More detailed information can be found in the sections below.
Who is responsible for collecting data on this website?
Data processing on this website is carried out by the website operator. The operator’s contact details must be provided in the legal notice (Impressum). The complete identity and postal address of the controller must be verified before this policy is published.
How do we collect your data?
Some data is collected when you provide it to us, for example by entering information in an enquiry or contact form. Other data may be collected automatically by our IT systems when you visit the website, including technical data such as your browser, operating system and the time of your visit.
What do we use your data for?
Some information is needed to deliver the website reliably and securely. Other information may be used to analyse visitor behaviour, but only if such analytics services are actually installed and used.
What rights do you have?
Within the limits of applicable law, you may request access to your personal data, correction of inaccurate data, deletion, restriction of processing and, where applicable, data portability. You may also object to certain processing activities or withdraw consent. You have the right to lodge a complaint with a competent data protection supervisory authority.
2. General information and mandatory disclosures
Data protection
The website operator takes the protection of personal data seriously and processes it in accordance with applicable data protection law. This notice explains the categories of personal data concerned, why it is processed and which rights you have. Data transmission over the internet, including email, may involve security risks; complete protection against access by third parties cannot be guaranteed.
Controller
The controller is the natural or legal person who determines the purposes and means of processing personal data, such as names and email addresses. The controller’s full name and postal contact details must be added after verification; a reference to the legal notice alone should not replace the required details.
Withdrawal of consent
Where processing is based on your consent, you may withdraw that consent at any time by contacting us, including by email. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
Right to data portability
Where personal data is processed automatically on the basis of consent or a contract, you may have the right to receive that data in a commonly used, machine-readable format and to transmit it to another controller. Direct transfer between controllers is possible only where technically feasible.
SSL or TLS encryption
Where HTTPS is enabled, data transmitted between your browser and the website is encrypted using SSL/TLS. You can generally recognise this by the https:// prefix and the security indicator in your browser.
Access, correction, restriction and erasure
You may request information about personal data stored about you, its origin, recipients and purpose, and request correction, restriction or deletion as provided by law. Statutory retention requirements may limit deletion.
Objection to unsolicited advertising
Contact details published to meet legal notice requirements must not be used to send unsolicited advertising or informational material. The operator reserves the right to take legal action against unsolicited promotional emails.
3. Collection of data on the website
Cookies
The former website policy stated that cookies were used to improve usability, effectiveness and security. Cookies are small text files stored by the browser. Session cookies may be deleted when the browser closes, while persistent cookies can remain until deleted. Browser settings can restrict or delete cookies. Whether and which cookies are actually used on the new website or app must be technically checked, along with their purposes, lifetimes and applicable legal bases. Non-essential cookies may require prior consent.
Server log files
The hosting provider may automatically record browser type and version, operating system, referrer URL, hostname, time of the server request and IP address. These logs may be needed for website delivery and security. The previous notice stated that these data were not combined with other data sources. The actual retention period, legal basis and hosting arrangements must be verified for the current deployment.
Contact and booking enquiry forms
When you submit a contact or booking enquiry, the details entered in the form, including contact information and journey details, are processed so that DTS Shuttle can handle your request and respond to follow-up questions. The current app also provides a direct server-side enquiry function. The recipients, technical transmission method, storage arrangements, legal basis (which may include Article 6(1)(b) GDPR for pre-contractual enquiries), and retention periods must be verified and described accurately. Information will not be disclosed to third parties without an appropriate legal basis.
Consent and retention for enquiries
The former notice described processing of contact form data on the basis of consent under Article 6(1)(a) GDPR and retention until deletion was requested, consent withdrawn or the purpose ceased to apply, subject to mandatory statutory retention periods. This basis and retention description must be reassessed for the new booking enquiry process.
Comment function
The former WordPress website policy included a comment function. If comments are enabled, the comment content, date, email address, optional username and potentially IP address may be processed. Comments and related data may remain until the content is removed or deletion is legally required. This section should be removed if the new website has no comment function.
Legal basis for comments
The old policy described comment storage as based on consent under Article 6(1)(a) GDPR, which could be withdrawn without affecting earlier lawful processing. Verify whether this processing still occurs.
Customer and contractual data
Personal data is processed as needed to initiate, perform or amend contractual relationships, generally under Article 6(1)(b) GDPR. Customer data is deleted when it is no longer required, subject to statutory retention obligations.
4. Analytics tools and advertising
Google Analytics
The former website used Google Analytics, a web analytics service. The old notice stated that analytics cookies could collect usage information and transmit it to Google servers, potentially outside the EU. Before retaining this section, verify whether Google Analytics is installed on the current website, its provider details, consent mechanism, data transfers and current legal basis. Do not treat the former notice’s reliance on legitimate interests as proof of compliance today.
IP anonymisation
The former notice stated that IP anonymisation was enabled so that IP addresses were generally shortened before transmission outside the EU. Verify whether this feature exists and is configured on the current website.
Browser opt-out
The previous notice referred to Google’s browser opt-out add-on: https://tools.google.com/dlpage/gaoptout?hl=en . Its relevance depends on whether Google Analytics is in use.
Objecting to data collection
The former website offered a Google Analytics opt-out mechanism using a cookie. Such a mechanism must not be claimed to work on the new website unless actually implemented and tested.
Google privacy information
Further information from Google is available at https://support.google.com/analytics/answer/6004245?hl=en .
Data processing agreement
The old policy stated that a data processing agreement had been concluded with Google. This must be checked for the current services and contracting entity.
Demographic features
The old policy stated that Google Analytics demographic and interest reports could be enabled and that users could adjust ad preferences in their Google account. Confirm whether any such reporting is active before including it in a final policy.
Google Ads and conversion tracking
The former website used Google Ads conversion tracking. The old notice described conversion cookies, their limited lifetime and conversion statistics. Whether advertising tags, conversion measurement or other tracking tools are present on the new website must be checked; current consent requirements, providers, data flows and retention periods must be documented.
Browser cookie settings
You can usually configure your browser to block, limit or delete cookies. Some website features may not work correctly if necessary cookies are disabled.
5. Plugins and tools
Google Web Fonts
The former website used fonts loaded from Google servers. This may transmit technical connection data, including IP addresses, to Google. The new website must be checked to establish whether fonts are loaded from third-party servers or hosted locally. Further information: https://developers.google.com/fonts/faq and https://policies.google.com/privacy .
For enquiries about your personal data, contact info@dts-shuttle.de.