Privacy Policy for the DIRS21 Online Booking Tool of TourOnline AG
The booking functionality on this website, within the framework of this online booking tool (“OBT”), is provided to you by TourOnline AG, Borsigstraße 26, 73249 Wernau, Germany (www.dirs21.de), hereinafter abbreviated as “TOAG”. Your data is collected and used in accordance with the provisions of the General Data Protection Regulation (EU) 2016/679 (GDPR), the German Federal Data Protection Act (BDSG), the Act on Data Protection and the Protection of Privacy in Telecommunications and Digital Services (TDDDG), and the Digital Services Act (DDG). Below, the controller responsible for data processing—inform you which data we collect and how we process this data.
1. Personal data
Personal data within the meaning of the GDPR comprises all information relating to an identified or identifiable natural person; a natural person is regarded as identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person. Personal data is stored only to the extent necessary to provide the booked service, to comply with legal requirements, or for the purpose stated below.
2. Controller Responsible for Data Processing
The controller for this OBT within the meaning of the GDPR and other national data protection laws of the Member States as well as other data protection regulations is:
TourOnline AG Borsigstraße 26
73249 Wernau, Germany
Email: info@dirs21.de
Telephone: +49 (0) 7153 9250 0
Fax: +49 (0) 7153 9250 40
(hereinafter abbreviated as “TOAG”)
3. The purpose for collecting personal data
You can access this online booking tool (“OBT”) without the collection of personal data being required. However, certain anonymized data is stored with each access, e.g., which offer was accessed. As a rule, this data is not personal and therefore does not fall under the statutory provisions of the GDPR or the BDSG.
TOAG collects data about accesses to the OBT and stores these as “server log files”. The following data is logged:
- Website visited
- Time at the moment of access
- Amount of data sent in bytes
- Source/referrer from which you reached the page
- Browser used
- Operating system used
- IP address used
The collected data serves solely for statistical evaluations and to improve the website. The website operator reserves the right to subsequently check the server log files if there are concrete indications of unlawful use.
Anonymous data is collected exclusively for statistical evaluation in order to improve our services. Please also refer to the section “Right of Access / Right to Withdraw.”
The collection of personal data becomes necessary if you book accommodation or another service through our OBT, for which personal data is indispensable to process the booking.
In line with the statutory principles of data minimisation, we generally collect only the data required to provide the specific service. Where our forms request additional information, providing it is always voluntary and labelled as such.
The temporary storage of the IP address by the system is necessary to enable delivery of the website to the user’s computer. For this, the user’s IP address must remain stored for the duration of the session. Storage in log files also takes place to ensure the website’s functionality. In addition, the data helps us optimise the website and ensure the security of our IT systems. No evaluation of the data for marketing purposes takes place in this context. These purposes also constitute our legitimate interest in data processing pursuant to Art. 6(1)(f) GDPR.
If you wish to contact a host directly via the contact form displayed for that host, the data you provide for this purpose will be stored and processed by us and transmitted to the respective host so they can contact you. No disclosure to third parties takes place.
In the event of booking a trip or another service, the data collected for this purpose will be used to process this booking, for advertising purposes within the statutory framework, and for statistical purposes.
4. Legal Basis for Processing Personal Data
Where we obtain the data subject’s consent for processing operations involving personal data, Art. 6(1)(a) GDPR serves as the legal basis.
For processing personal data necessary for the performance of a contract to which the data subject is party, Art. 6(1)(b) GDPR serves as the legal basis. This also applies to processing operations necessary for carrying out pre-contractual measures.
Where processing personal data is necessary for compliance with a legal obligation to which our company is subject, Art. 6(1)(c) GDPR serves as the legal basis.
If processing is necessary to protect the vital interests of the data subject or another natural person, Art. 6(1)(d) GDPR serves as the legal basis.
If processing is necessary for the purposes of the legitimate interests pursued by our company or by a third party and these interests are not overridden by the interests or fundamental rights and freedoms of the data subject, Art. 6(1)(f) GDPR serves as the legal basis.
5. Disclosure of Personal Data to Third Parties
Your personal data will be disclosed exclusively in compliance with the relevant statutory provisions, in particular data protection and competition law.
Where necessary for the performance of our contractual obligations or legal duties, your data may also be passed on to subcontractors or service providers to provide the service on our behalf or in our name (e.g., technical handling of postal and email dispatch, payment processing, customer service).
In addition, data is passed on to persons or companies to process your booking, in particular to airlines, tour operators, hotels, travel agencies, car rental companies, cruise lines, authorities, etc. Please note that the data protection provisions at the registered office of these persons and companies may differ from those in Germany.
Disclosure and transmission of your data to third parties also takes place where we are obliged to do so by law or by final court order.
You have the right to receive the personal data concerning you which you have provided to us in a structured, commonly used, and machine-readable format. You also have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided.
6. Transfer of Data to a Third Country or to an International Organisation
Data is transferred to third countries (countries outside the European Economic Area—EEA) only insofar as is necessary for the performance of our services, required by law, or you have given your consent. Where legally required, we will inform you of the details.
We also use tools from companies based in the USA or other third countries that do not have a level of data protection comparable to that of the EU. If these tools are active, your personal data may be transferred to these third countries and processed there.
We point out that the USA, as a secure third country, generally has a level of data protection comparable to that of the EU. A transfer of data to the USA is permissible if the recipient is certified under the “EU–US Data Privacy Framework” (DPF) or has appropriate additional safeguards.
We also point out that in other third countries a level of data protection comparable to that of the EU cannot be guaranteed. For example, companies may be obliged to hand over personal data to security authorities without you, as the data subject, being able to seek legal redress. It cannot be ruled out that authorities, such as intelligence services, process, evaluate, and permanently store your data stored on servers in third countries for surveillance purposes. We have no influence over such processing activities.
7. Storage and Deletion of Data
Within the scope of the purposes stated under “Purpose of Collecting Personal Data,” your personal data is stored. The personal data of the data subject will be deleted or blocked as soon as the purpose of storage ceases to apply. Storage may take place beyond this if provided for by the European or national legislator in EU regulations, laws, or other provisions to which the controller is subject. The legislator has enacted diverse retention obligations and periods. Blocking or deletion of the data also takes place when a retention period prescribed by the aforementioned standards expires, unless there is a necessity for further storage of the data for the conclusion or fulfilment of a contract.
8. Use of Cookies and Comparable Technologies
We use cookies (small text files that the web server sends to your internet browser) to improve your experience when visiting our online services. For example, certain notices will appear only once if you allow us to set a cookie. Our cookies also have an expiry date. If you delete your cookies manually before they expire, you will receive a new one on your next visit to the site unless you block cookie storage.
By design, only the server that sent a cookie can read it. We assure you that we do not store personal data in cookies.
Use of our services is only possible to a limited extent without accepting cookies. We therefore recommend permanently enabling cookies for our website. Most internet browsers are set to accept cookies automatically. However, you can disable the storage of cookies and set your internet browser to notify you as soon as cookies are sent.
The legal basis for processing personal data using cookies is Art. 6(1)(f) GDPR.
The legal basis for processing personal data using cookies for analytical purposes is Art. 6(1)(a) GDPR where the user has given consent.
9. Use of Google Analytics
This website uses the Google Analytics 4 web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).
If consent is given, Google Analytics 4 uses cookies that enable an analysis of website use. In this case, the legal basis is Art. 6(1)(a) GDPR. The information collected about website use (e.g., pages viewed, interactions, device type, approximate location) is generally transmitted to a Google server and stored there.
We have also implemented Google Consent Mode V2. This ensures that the processing of personal data depends on your consent:
- If consent is given, processing takes place as described above using cookies.
- If consent is refused, no cookies are set. Instead, Consent Mode transmits so-called pings (cookieless signals) to Google. These contain only basic technical information (e.g., timestamp, referrer, consent status, browser information). Google uses this information to create modeled conversions, enabling us to obtain aggregated statistical evaluations even without cookies.
Within Consent Mode V2, the following consent types are particularly considered:
- ad_storage (ad storage)
- analytics_storage (analytics storage)
- ad_user_data (user data for advertising purposes)
- ad_personalization (personalised advertising)
The processing of personal data based on the signals transmitted via Consent Mode V2 takes place pursuant to Art. 6(1)(f) GDPR (legitimate interest), as we have a legitimate interest in the statistical analysis of user behaviour and in optimising our online offering.
Data may be transferred to Google servers in the USA. For transfers to the USA, Google relies on the EU–US Data Privacy Framework. Further information about Google’s data processing can be found at: https://policies.google.com/privacy.
The Google tracking codes on this website use the function “_anonymizeIp()”, so IP addresses are further processed only in truncated form in order to exclude direct personal reference. You may object to data collection and storage at any time with future effect. By clicking the “Disable” button, tracking is completely prevented. You can withdraw or change any consent you have given at any time via the consent management tool implemented on our website. For the objection to be stored permanently, the browser used must accept cookies.
Alternatively, you can object to data collection by using a Google browser plug-in to prevent information collected by cookies (including your IP address) from being sent to and used by Google Inc. The following link leads to the relevant plug-in: https://tools.google.com/dlpage/gaoptout?hl=de
10. Use of Google
Our online presence uses Google Fonts and the Google Fonts API to display fonts and icons. If the data is not stored on our online presence’s local servers, Google collects, processes, and uses data on the use of the Fonts functions by visitors to the websites. More detailed information about data processing by Google can be found in Google’s privacy notices at http://www.google.com/privacypolicy.html. In the Privacy Center, you can also change your settings so that you can manage and protect your data. The terms of use for Google Fonts can be found at https://fonts.google.com/about# and https://policies.google.com/terms?hl=en.
11. Use of Microsoft Clarity
Our online presence uses the analytics service Microsoft Clarity, offered by Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.
When visiting this website, personal data is processed. In particular, categories of data are processed that serve to produce usage statistics.
Purpose of processing:
Processing is carried out for anonymisation, for creating statistical evaluations, and for analysing the usage behaviour of our website visitors. This information helps us improve our online offering technically and make it more user-friendly.
Legal basis for processing:
Your personal data is processed on the basis of your consent pursuant to Art. 6(1)(a) GDPR.
Recipient of the data:
Data is transferred to the independent controller Microsoft Ireland Operations Ltd.
One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.
The legal basis for transferring data to Microsoft Ireland Operations Ltd. is likewise your consent pursuant to Art. 6(1)(a) GDPR.
Personal data may also be transferred to a country outside the European Union. Transfers of data to the USA take place pursuant to Art. 45 GDPR in conjunction with the European Commission’s adequacy decision C(2023) 4745, as the data recipient has committed to complying with the principles of the EU–US Data Privacy Framework (DPF).
Further information on data protection at Microsoft can be found at:
https://privacy.microsoft.com/de-de/privacystatement
For data protection inquiries to the Data Protection Officer of Microsoft Ireland Operations Ltd., you can use the following contact form:
https://www.microsoft.com/en-us/concern/privacyrequest-msa
12. Verwendung of a Content Delivery Network
Our online presence uses “Bunny”, a content delivery network (“CDN”) from BUNNYWAY d.o.o., Cesta komandanta Staneta 4A, 1215 Medvode, Slovenia (“Bunny”). A CDN is an online service that delivers large media files in particular (e.g., graphics, page content, or scripts) via a network of regionally distributed servers connected via the internet. Using Bunny’s CDN helps us optimise our website’s loading speeds. Bunny generally does not interact with visitors to our website and does not process any personal visitor data. Should processing occur in isolated cases, this takes place pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in secure and efficient provision as well as improving the stability and functionality of our website. Further information can be found in Bunny’s Privacy Policy: https://bunny.net/privacy.
13. Use of Error Logging
Our online presence uses Sentry. The service is offered by Functional Software, Inc., 132 Hawthorne St, San Francisco, CA 94107. The service collects and stores data that is compiled from anonymised usage profiles. This serves exclusively to analyse error cases and monitor system stability. Cookies are used for this purpose. You may object to Sentry’s data collection and storage at any time with future effect by disabling cookies in your browser settings. Sentry’s Privacy Policy is available at https://sentry.io/privacy/.
14. Use of Icons
Our online presence uses web fonts provided by Fonticons, Inc. for the uniform display of fonts. When a page is called up, your browser loads the required web fonts into its cache to display texts and fonts correctly.
For this purpose, the browser you use must connect to Fonticons, Inc.’s servers. This informs Fonticons, Inc. that our website was accessed via your IP address. The use of web fonts is in the interest of a uniform and appealing presentation of our online offerings. This constitutes a legitimate interest pursuant to Art. 6(1)(f) GDPR.
If your browser does not support web fonts, a standard font from your computer will be used.
Further information about Font Awesome can be found at https://fontawesome.com/help and in Fonticons, Inc.’s Privacy Policy: https://fontawesome.com/privacy.
15. Automated Individual Decision-Making
A fully automated decision means decisions made by technical means without the direct involvement of a person.
Automated decision-making pursuant to Art. 22 GDPR does not take place on our website. If we use this procedure in individual cases, we will inform you separately—where required by law.
16. Right of Access / Right to Withdraw; Other Data Subject Rights
You have the right:
- pursuant to Art. 15 GDPR, to obtain access to your personal data processed by us. In particular, you can obtain information about the purposes of processing, the categories of personal data, the categories of recipients to whom your data have been or will be disclosed, the planned storage period, the existence of the right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the source of your data if not collected from you, and the existence of automated decision-making including profiling and, where applicable, meaningful information about the details involved;
- pursuant to Art. 16 GDPR, to obtain without undue delay the rectification of inaccurate personal data concerning you or the completion of your data stored by us;
- pursuant to Art. 17 GDPR, to obtain the erasure of your personal data stored by us unless processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise, or defence of legal claims;
- pursuant to Art. 18 GDPR, to obtain restriction of processing where you contest the accuracy of the data, the processing is unlawful but you oppose erasure and we no longer need the data, you need the data for the establishment, exercise, or defence of legal claims, or you have objected to processing pursuant to Art. 21 GDPR;
- pursuant to Art. 20 GDPR, to receive the personal data that you have provided to us in a structured, commonly used, and machine-readable format or to request the transmission to another controller;
- pursuant to Art. 7(3) GDPR, to withdraw your consent at any time with effect for the future. This means we may no longer continue the data processing that was based on this consent; and
- pursuant to Art. 77 GDPR, to lodge a complaint with a supervisory authority. As a rule, you can contact the supervisory authority at your habitual residence or place of work or at our company’s registered office.
To withdraw your consent to the use of data, to request access, rectification, blocking, or erasure, or to exercise the other data subject rights, please contact:
73249 Wernau, Germany
Email: info@dirs21.de
Telephone: +49 (0) 7153 9250 0
Fax: +49 (0) 7153 9250 40
You are, of course, entitled to these rights free of charge without incurring transmission costs which are higher than the basic rates.
Below we also provide the contact address of our company’s Data Protection Officer. Our Data Protection Officer is:
Attorney Frank Hütten, Noll & Hütten Rechtsanwälte GbR, c/o TourOnline AG
Borsigstrasse 26
73249 Wernau, Germany
Email: datenschutzbeauftragter@dirs21.de
Tel.: +49 (0) 7153 9250 0
Fax: +49 (0) 7153 9250 40
Please do not directly contact the data controller in order to exercise your rights such as access, correction, restriction or erasure of your personal data, but first contact the above-mentioned data protection officer directly, who will process your request immediately.
17. Competent Supervisory Authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority—particularly in the Member State of your habitual residence, place of work, or the place of the alleged infringement—if you consider that the processing of personal data concerning you infringes the GDPR.
The supervisory authority with which the complaint has been lodged informs the complainant of the progress and the outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.
You can contact the supervisory authority competent for you for complaints within the meaning of Art. 77 GDPR at the following contact details:
State Commissioner for Data Protection and Freedom of Information Baden-Württemberg
Street address:
Königstraße 10a
70173 Stuttgart
Postal address:
Postfach 10 29 32
70025 Stuttgart
Phone: 0711 / 61 55 41 – 0
Email: poststelle@lfdi.bwl.de
18. Security, Questions and Suggestions, Controller
Security also depends on your system. You should always keep your access information confidential, never allow the web browser to store passwords, and close the browser window when you finish visiting our website. This makes it more difficult for third parties to access your personal data.
Use an operating system that can manage user rights. Set up multiple users on your system within your household and never use the internet with administrator rights. Use security software such as virus scanners and firewalls and keep your system up to date.
The controller for this online booking tool (“OBT”) within the meaning of the GDPR and other national data protection laws of the Member States as well as other data protection provisions is:
TourOnline AG
Borsigstraße 26
73249 Wernau, Germany
Email: info@dirs21.de
Phone: +49 (0) 7153 9250 0
Fax: +49 (0) 7153 9250 40