Source: https://www.turbopass.com/data-protection
Timestamp: 2019-04-22 16:05:00+00:00

Document:
We have, of course, taken technical and organizational measures to ensure compliance with statutory data protection provisions. We have also taken precautions against unauthorized access by third parties. However for clarity we point out that the transmission of data - particularly through the internet via email – can be subject to holes in security. Unfortunately, it is never possible to completely protect data against access by third parties. In addition, we cannot monitor the use by third parties of data published on the website.
Our webpages can be visited anonymously without providing personal information.
Frequent appearance on many other websites – it is technically necessary that data are transmitted to our server via your internet browser. The following data are recorded during an on-going connection for communication purposes between your internet browser and our web server: the visited domain, the operating system used by you, the browser you use, the date and time of your visit to our website and the URL of the page previously visited (referrer address), the access status (file transfer, file not found, etc), the IP address of the requesting computer, the amount of data transferred.. This is merely for statistical purposes and the improvement of our service. We ensure that these data cannot be associated with any particular person. In addition, the log file serves the evaluation of system security and stability as well as administrative purposes. The legal basis for the temporary storage of data or log files is Art. 6 para. 1 lit. f DSGVO.
However, we can only provide you with some of our services if we obtain personal data from you. This data is collected on a voluntary basis. For example, we generate personal data if you use our services and book tickets or other services through our website. In this case, you will be requested to carefully read this data protection policy and then declare your consent to the use of your data prior to the conclusion of the booking process.
If you transmit data to us - even without being registered – e.g. booking requests, form data etc. this data can be made anonymous and used for statistical purposes. This is also the case if no booking is made.
Due to reasons of technical security, in particular, to ward off attacks on our web server, this data may be temporarily stored by us. Tracking back individuals based on this data is not possible. After seven days at the latest, the data is anonymised by shortening the IP address to the domain level, so that it is no longer possible to relate to the individual user. There is no evaluation of this data except for statistical purposes in anonymous form. A merge of this data with data from other data sources is not performed.
Information about our customers helps us to personalize your shopping experience with Turbopass and further improve it. It is not our business to sell this information. We save the data provided by you primarily for order processing. This applies to your name and address, date of birth, user name and password, email address and telephone number as well as the date and time of your registration. When you first make an order or use functions that require registration, your data are saved to set up a customer account to make it quicker and easier for you to purchase our services in the future. You gain the opportunity with your user account to use other parts of our website and to log in to the offers you have purchased. Legal basis of the data processing is with consent Art. 6 Abs. 1 lit. a DSGVO or Art. 6 para. 1 lit. b DSGVO, if processing is required to provide the requested services. Your data will be deleted as soon as the user account on our website is deleted and there are no statutory storage requirements. A change and of your user account, including the data you have provided, can usually be done directly in your user account after logging in. A deletion of your account can be done by sending a message to the afore-mentioned person in charge.
Your personal data may upon consent be used for our own advertising initiatives (emails, newsletters, etc.). You can object to these advertising initiatives at any time by revoking your consent by email to dataprotection [at] turbopass.com or by writing to the above address. In no event will we pass on your details to third parties for commercial purposes.
In order to exclude misuse by external parties, we reserve the right to save your IP-address during the registration or booking process.
When you pay for the services you have booked, the payment is processed by different payment service providers. Turbopass does not save any payment information during this process. During the payment process, the payment service provider will inform you of its own data protection provisions and request you to agree to them.
In regard to card payments (direct debit/girocard/credit cards) we work together with Concardis GmbH (Concardis), Helfmann Park 7, D-65760 Eschborn, represented by its managing directors ark Freese, Jens Mahlke and Luca Zanotti. In addition to the purchase amount and date, card data are also transmitted to the above-mentioned company. All payment data and data on any chargeback that may occur are only stored as long as they are needed for the processing of payments (including the processing of possible chargeback and collection of receivables) and for the fight against misuse; generally, the data will be deleted no later than 13 months after it has been collected. Beyond that, further storage may be undertaken if and as long as this is necessary to comply with a statutory retention period or to prosecute a specific case of misuse. The legal basis for data processing is according to Art. 6 para. 1 f) General Data Protection Regulation. You may request information and, if necessary, rectification or deletion, as well as the limitation of the processing of your data and/or possibly object to the processing of your data. If you have any questions about data processing by Concardis or to assert your rights, you can contact the Data Protection Officer, either through the given address or by email at Datenschutzbeauftragter@concardis.com. Furthermore, you have the right to complain to a supervisory authority (in Germany at the State Data Protection Commissioner). Please note that the provision of payment data is neither legally nor contractually required. If you do not want to provide your payment details, you can use a different payment method (e.g. cash payment).
In addition, we offer the payment via PayPal. The provider of the payment service is PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter "PayPal"). If you pay via PayPal, the payment details you enter will be sent to PayPal. The basis for the transmission are Art. 6 Art. 6 para. 1 lit. a DSGVO (consent) and Art. 6 para. 1 lit. b DSGVO (processing to fulfil a contract). You have the right to revoke your consent to data processing at any time. Revocation does not affect the effectiveness of historical data processing operations.
In addition, we offer the payment via "Sofortüberweisung", a payment service of Sofort GmbH, Theresienhöhe 12, 80339 Munich (hereinafter "Sofort GmbH"). Upon payment via “Sofortüberweisung”, among others, for identity verification and to prevent attempts at fraud, the following personal data is transmitted to the Sofort GmbH: First and last name, address, telephone number (s), email address, IP address and possibly other data required for payment processing. The basis for the transmission of your data to Sofort GmbH are Art. 6 Art. 6 para. 1 lit. a DSGVO (consent) and Art. 6 para. 1 lit. b DSGVO (processing to fulfill a contract). You have the right to revoke your consent to data processing at any time. Revocation does not affect the effectiveness of historical data processing operations.
If you do not want cookies to be used, you can prevent this: the help function in the menu list of most web browsers explains how you can configure your browser so that it will not accept new cookies, will notify you of new cookies, or will delete all cookies already received. However, cookies permit you to use some of the functions on our website, so we recommend you to leave the cookie function switched on.
This data cannot be associated with specific persons. A combination of this data with other data sources will not occur. We reserve the right to examine this data later if we discover concrete evidence of unlawful use.
If you send us inquiries using the contact form, the information entered into the form, including the indicated contact information, is used to process the inquiry, and is saved for possible follow-up questions. The information will not be passed on to anyone without your permission. The legal basis for processing the data is our legitimate interest in answering your request in accordance with Art. 6 para. 1 lit. f DSGVO and Art. 6 para. 1 lit. b DSGVO, if your request sets toward the completion of the contract. Your data will be deleted after final processing of your request, as long as no legal storage requirements are in conflict.
You can unsubscribe from the newsletter at any time via the link inserted in each newsletter or an e-mail to the person mentioned above. After cancellation, your e-mail address will be deleted immediately from our newsletter distribution, as far as you have not expressly consented to a continued use of the collected data or the continued processing is otherwise permitted by law.
This website uses Google Analytics, a web analysis service by Google Ireland Limited („Google"), Gordon House, Barrow Street, Dublin 4, Ierland. Google Analytics uses so-called "cookies", which are text files that are stored on your computer and enable your use of the website to be anlayzed. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there. In the event that IP anonymization is activated on this website, your IP address will, however, be abbreviated by Google prior to this within the member states of the European Union or other European Economic Area member states, whereby a direct reference to a person will be impossible. Only in exceptional cases will your full IP address be transmitted to a Google server in the USA and abbreviated there. Google Inc., based in the United States, is certified to the European Privacy Convention "Privacy Shield", which ensures compliance with the level of data protection in the EU. The processing is carried out in accordance with Art. 6 para. 1 lit. f DSGVO or § 15 Abs. 3 TMG based on our legitimate interest in the statistical analysis of user behaviour for optimization and marketing purposes.
Our website uses Google AdSense, an online advertising service by Google Ireland Limited ("Google"). Google AdSense uses so-called "cookies", which are text files that are stored on your computer and enable your use of the website to be analyzed. Google AdSense also uses so-called web beacons (invisible graphics). Through these web beacons, information such as the user traffic on the offer pages can be analyzed. The information produced by cookies and web beacons (including the IP address of the user) about the use of this website and delivery of advertising formats are transmitted to a server in the USA and stored there. This information can be passed on to Google's contract partners by Google. However, Google will not combine your IP address with other stored personal data.
d) through permanent deactivation by a browser plug-in.
The settings under b) and c) are deleted when cookies are deleted in the browser settings.
This website uses the remarketing or "similar target groups" function by Google Ireland Limited ("Google"). With this function, the provider of the website can address the visitors of the website with target-oriented advertising, in which the visitors to the provider's website are shown personalized advertisements when they visit other websites in Google's advertising network. For analyzing the website usage, which is the foundation of the creation of personalized advertisements, Google uses so-called cookies. For this purpose, Google saves a small file with a sequence of numbers in the browsers of the website visitors. With this number, the visits to the website as well as anonymized information about the use of the website is collected. Personal data of the website visitors is not stored. Google uses this information to provide functions for display advertising, such as remarketing, reports about impressions in the Google advertising network, or Google Analytics reports about the performance in various demographics or interest areas. Google may also pass this information on to third parties if required by law or if the third parties process the data on behalf of Google.
- other types of personalized advertising.
We use these Google AdWords functions to readdress visitors of this website on websites of third party providers or address internet users with specific interest profiles based on their internet use. With our cookies, remarketing lists, or other anonymous IDs, we do not collect any personal data.
We may provide your data to third parties if this is permitted by statute (for example, the German Data Protection Act), and is also necessary, such as the provision of your data to criminal prosecution and regulatory authorities to defend state and public security, as well as for the prosecution of crime. The use of stored data for the performance of the contract also includes passing on your data to third parties and their use of the data where this is necessary to find, perform and conclude your user relationship and any purchase contracts that have been entered.
The duration of the storage of personal data is determined by the relevant statutory retention periods (e.g. from commercial law and tax law). After expiry of the respective deadline, the corresponding data will be routinely deleted. If data is required to fulfil the contract or to initiate an agreement or if we have a legitimate interest in the re-storage, the data will only be deleted if you are no longer required for these purposes or if you exercise your right of revocation or objection.
The website contains links to and (if applicable) from the websites of third parties. If you follow a link to one of these websites, please be aware that these websites are subject to their own data protection provisions and that we cannot accept responsibility for data protection by other parties. Before transmitting your data to third parties you should read their data protection policy.
Under the German Data Protection Act you have a right to be given information related to the data we have stored about you free of charge. You are entitled to the correction, restriction of processing or deletion of such data. In addition, you have the right to transfer your personal data to other persons responsible (data transferability according to Art. 20 GDPR) as well as the right of complaint and the revocation of granted consent. Requests can be sent at any time and in no special form, to dataprotection [at] turbopass.com or Turbopass GmbH, Fuhlsbüttler Str. 399 b, 22309 Hamburg..
You can also object to anonymized data collection and storage. You also have the option to revoke an existing consent at any time. The specification of reasons is not required for this purpose. Please direct contradictions of this kind to dataprotection [at] turbopass.com (please replace the [at] in your email with the @ sign) or send it via post to the address mentioned above.
We will notify you of any changes to our Data Protection Policy here. We therefore request that you visit this page regularly.

References: Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 § 15
 Art. 20