Identification of the responsible body
The responsible body for data processing (decisions on the purposes and means of processing personal data, such as names, contact details, etc.) on this website is:
de Vries/Mandler/Mathews GbR
Fruchtallee 124, 20259 Hamburg
Revocation of your consent to data processing
Some data processing operations are only possible with your explicit consent. A revocation of your already given consent is possible at any time. An informal notification by e-mail is sufficient for the revocation. The legality of the data processing carried out until the revocation remains unaffected by the revocation.
Complaints to the competent supervisory authority
In the event of a breach of data protection law, you (as the concerned party) have the right to file a complaint with the competent supervisory authority. The competent supervisory authority with regard to data protection issues is the data protection officer of the federal state in which our company has its registered office (Hamburg, Germany). The following link provides a list of data protection officers and their contact details: https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html.
You have the right to have data which we process automatically on the basis of your consent or in fulfilment of a contract handed over to you or to third parties. The information is provided in a machine-readable format. If you request the direct transfer of the data to another responsible person, this will only be done as far as it is technically feasible.
Information, correction, blocking, deletion
You have the right to free information about your stored personal data, the origin of the data, its recipients and the purpose of the data processing and, if applicable, the right to correction, blocking or deletion of this data at any time within the framework of the applicable statutory provisions. In this regard and also for further questions on the subject of personal data, you can contact us at any time via the contact options listed in the legal notice.
SSL or TLS encryption
For security reasons and to protect the transmission of confidential content that you send to us as the site operator, our website uses SSL or TLS encryption. This means that data that you transmit via this website cannot be read by third parties. You can recognize an encrypted connection by the “https://” address line of your browser and by the lock symbol in the browser line.
Server log files
In server log files, the provider of the website automatically collects and stores information that your browser automatically transmits to us. These are: Page visited on our domain, date and time of the server request, browser type and browser version, operating system used, referrer URL, host name of the accessing computer, IP address.
These data are not merged with other data sources. The data processing is based on Art. 6 para. 1 lit. b DSGVO, which permits the processing of data for the fulfilment of a contract or pre-contractual measures.
Data transmission when placing an order
Personal data will only be transmitted to third parties if necessary within the framework of contract processing. For example, third parties may be payment service providers or logistics companies. A further transmission of the data does not take place or only if you have expressly agreed to it.
The basis for data processing is Art. 6 para. 1 lit. b DSGVO, which permits the processing of data for the fulfilment of a contract or pre-contractual measures.
Data transmission when paying
Our website enables payment via SendOwl. Provider of the payment service is Concept Den Limited, 107 Cheapside, 9th Floor, London EC2V 6DN, UK.
If you pay with SendOwl, the payment data you enter will be transmitted to SendOwl. You can find out more about the transfer and processing of your payment details at https://www.sendowl.com/privacy.
The transfer of your data to SendOwl is based on Art. 6 para. 1 lit. a DSGVO (consent) and Art. 6 para. 1 lit. b DSGVO (processing to fulfil a contract). You may revoke your consent at any time. Data processing operations in the past remain effective in the event of revocation.
Data storage when playing
During the walking tours, players are asked to send photos (“selfies”). Sending a photo is voluntary and is not required for progress in the game. Players can object to the transmission of data by means of a negating text message (e.g. “No”) or the “Skip” function.
The submitted photos will be used exclusively for the creation of an individual photo collage, which will be presented to the players later in the game. For the purpose of the automatic creation of the photo collage, the photos provided by the players will be temporarily stored on a server of our hosting provider RAIDBOXES, Hafenstraße 32, 48153 Münster, Germany. The photos are automatically deleted after 48 hours.
Data transmitted via the contact form including your contact data will be stored in order to be able to process your request or to be available for follow-up questions. These data will not be passed on without your consent.
The data entered in the contact form will be processed exclusively on the basis of your consent (Art. 6 para. 1 lit. a DSGVO). A revocation of your already given consent is possible at any time. An informal notification by e-mail is sufficient for the revocation. The legality of the data processing operations carried out until the revocation remains unaffected by the revocation.
Data transmitted via the contact form will remain with us until you request deletion, revoke your consent to storage or until data storage is no longer necessary. Mandatory legal provisions – in particular retention periods – remain unaffected.
Our website uses functions of the web analysis service Google Analytics. Provider of the web analytics service is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
Google Analytics uses “cookies”. These are small text files that your web browser stores on your device and allow analysis of website usage. Information generated by cookies about your use of our website is transmitted to a Google server and stored there. The server location is usually the USA.
Google Analytics cookies are set on the basis of Art. 6 para. 1 lit. f DSGVO. As the operator of this website, we have a legitimate interest in analysing user behaviour in order to optimise our website and, if necessary, advertising.
IP anonymisation. We use Google Analytics in conjunction with the IP anonymization function. It ensures that Google shortens your IP address within member states of the European Union or in other signatory states to the Agreement on the European Economic Area prior to transmission to the USA. There may be exceptions in which Google transfers the full IP address to a server in the United States and abbreviates it there. On our behalf, Google will use this information to evaluate your use of the website, to create reports on website activity and to provide us with other services relating to website activity and internet usage. The IP address transmitted by Google Analytics is not merged with other Google data.
Browser plugin. The setting of cookies by your web browser can be prevented. However, some functions of our website may be restricted as a result. You may also opt out of the collection of data about your website usage, including your IP address and subsequent processing by Google. This is possible by downloading and installing the browser plugin accessible via the following link: https://tools.google.com/dlpage/gaoptout?hl=en.
Objection to data collection. You can prevent Google Analytics from collecting your data by clicking on the following link. An opt-out cookie is set to prevent your information from being collected on future visits to our website: Disable Google Analytics.
Order processing. We have entered into an order processing agreement with Google in order to fully comply with legal data protection requirements.
Demographic characteristics of Google Analytics. Our website uses the function “demographic features” of Google Analytics. It can be used to create reports that contain statements about the age, gender and interests of the site visitors. This data comes from interest-related advertising by Google and visitor data from third parties. It is not possible to assign the data to a specific person. You can deactivate this function at any time. This is possible via the ad settings in your Google Account or by generally prohibiting the collection of your data by Google Analytics, as explained under “Objection to data collection”.
The original policy (in German) was created using the data protection configurator of mein-datenschutzbeauftragter.de.