Source: https://huntermeetshunter.com/en/datenschutzrichtlinien
Timestamp: 2019-04-23 00:28:21+00:00

Document:
With the purchase of tickets for hunting events, an "event contract" is created between the user and the organiser, for the fulfillment and processing of which the organiser alone is responsible; in case of an exchange both contracting parties are organisers. The organiser will be shown separately (as responsible person) when a ticket is purchased. The transmission of the data necessary for the execution of the purchase contract to the organiser (and vice versa) is absolutely necessary for the fulfillment of the purpose of the contract. When handling the ticket sales contracts, Hunter meets Hunter GmbH acts as processor for the organiser and bases its data processing on a contract data processing contract.
(j) Transmission of user's electronic identification data to third parties for incorporating content through posts on social networks (e.g., youTube) and other applications (e.g., Google Maps).
a) Online use:The use of the online service is already based on a contract as defined in Art. 6 (1) (b) GDPR (Kühling/Buchner DS-GVO [GDPR] 2017, Art. 6 (59)) ; a registration relationship is established upon registration.
b) Conclusion of ticket purchase contracts:In the case of the purchase of tickets, the data processing of the organizer is based on the contract concluded in each case and serves the purpose of fulfilling the contract (see the comments under point 4).
For individual services (such as newsletters), the person responsible explicitly solicits the customer's consent. This consent can be withdrawn at any time with effect for the future.
The controller will store the IP addresses of its customers for a period of 7 days in order to protect against targeted attacks in the form of server overloads (Denial of Service attacks) or other damage to the systems. The controller has an overriding legitimate interest in such data processing for the purposes of maintaining the functionality of its online services (Recital 49 GDPR).
• for the transmission of electronic mail after consent and in accordance with § 107 para. 3 TKG.
When using this data, the responsible person complies with the communication regulations, in particular § 107 TKG.
Facebook uses the "Facebook pixel" set by the person responsible in its services in order to store cookies on the user's device and to read out existing cookies, other identifiers and to enrich the profile created for the identifier or user. The responsible person has access to these data collected by Facebook, but uses them to show advertising to the target group of those interested in the service of the responsible person.
Dissemination of Information / Advertising: The person responsible informs that he also processes the personal data of the customer for the purpose of disseminating information / direct mail and for purposes of retargeting. The responsible person wants to inform about their own services and events of the organizers and to promote them. For this purpose, these data will not be left to third parties under its responsibility. There is no inconsistency with the purpose of the original data collection. The customer may object to the use of his personal data for the purposes of direct advertising at any time and without giving reasons.
For the purpose of compiling suitable recommendations the controller processes and evaluates search and user behaviour, and draws conclusions about specific personal interests. The controller uses those evaluated interests to send the customer targeted recommendations.
The customer may object to the use of his personal data for the purpose of profiling at any time and without having to state reasons. Upon objection the controller will no longer use the customer's personal data for the purposes of profiling.
The customer is under no obligation to provide data. Reasonable use of the platform is, however, inconceivable without entering any data.
The customer is subject to noautomated decision-making, which would become legally effective vis-à-vis him.
All external recipients can be written to and contacted via the controller with regard to questions under data protection law.
Types of data: Google Analytics: anonymised IP address, website title, browser-specific information, information about website use.
Types of data: Social plug-ins: IP address, website title, browser-specific information, information about website use.
The person responsible informs that he has independent online presence for the purpose of advertising and communication with the customers in social media channels. In these online appearances, the customer's data may be processed outside of the European Union, which increases the risk of data breach. The operators of the social media channels have, as far as they are based in the US, largely subordinated to the EU-US Privacy Shield.
These online appearances are kept retrievable in the technical environment of the respective social media operator. The social media operators then use the customer's online presence visit for their own purposes, in particular to play out (interest-based) advertising. The social media operators use the visit in order to store "cookies" on the customer's terminal, to read out existing cookies / identifiers, to deduce the user's behavior from the customer's interests and thus to enrich the usage profile specified for the customer or identifier , The aim is to play out interest-based advertising to the customer, which can also be done on subsequently visited third party websites.
The personal data of the customer is processed on the basis of the legitimate interests of the person responsible for the advertising measures and the customer communication, which is governed by the freedom of work (Art. 6 StGG) and freedom of communication (in Art 10 ECHR, which also protects advertising measures) - and constitutionally protected. If the customers are users of the social media channels, the data processing can also be covered by the customer's consent.
The responsible informs that she has no access to the data of the customer. The person responsible therefore recommends that the customer, in the event of the assertion of his rights to information, correction, deletion, restriction, opposition and data portability, address the relevant social media channel directly. The users of social media channels can also make changes themselves in the area of their privacy settings. The responsible person assists the customer if necessary.
Non-registered users:Personal data (in particular the IP address) of (non-registered) visitors to the website will be stored for purposes of IT security for a period of 7 days.
Registered employers:Generally, personal data of registered employers will be processed by the controller on the legal basis stated above for another 40 months after termination of the contract(= 36 months for potential contractual claims for damages + max. 4 months service period for a statement of claim) and then deleted (in any case, links to personal data). In any case the use agreement will end after a period of 7 years of inactivity and will lead to immediate deletion.
The customer shall have the right to obtain confirmation as to whether or not his personal data is being processed.
The customer shall have the right to obtain without undue delay the rectification of inaccurate personal data or to have them completed.
The customer shall have the right to obtain the erasure of personal data without undue delay as long as the reasons stated in Art 17(1) GDPR are fulfilled.
The customer shall have the right to obtain restriction of processing of personal data as long as the reasons stated in Art 18(1) GDPR are fulfilled.
Objection to profiling. The customer shall have the right to object to processing of his personal data for the purposes of profiling at any time.
Objection to direct marketing: The customer shall have the right to object to processing of his personal data for the purposes of direct marketing at any time.
Art 20 GDPR "Data portability"
The customer shall have the right to receive the personal data concerning him in a structured, commonly used and machine-readable format.
Each customer shall have the right to lodge a complaint with the supervisory authority if he considers that the processing of personal data relating to him infringes this Regulation.

References: Art. 6
 Art. 6
 § 107
 § 107
 Art 10
 Art 17
 Art 18

Art 20