Business Partners Data Protection

Data protection information for business contact

DER Touristik UK Ltd (hereinafter referred to as "Kuoni", “we” or “us”), as controller, processes your data in order to contact you. This information therefore applies to personal data provided to Kuoni in the course of its business or other activities by post, telephone, fax, e-mail or online. Through this data protection information, we would like to inform you about the scope and purpose of the processing as well as your rights as a data subject.

Persons who provide personal data of others to us must ensure that the data subjects agree to the provision and are informed about how personal data may be processed by us and what rights data subjects have.

(Status: August 2022).

1. Purposes and legal basis of the processing of personal data

1.1 Establishing contact within the scope of a business relationship

For the initiation or implementation of a business relationship, we will process your contact data (name, address, telephone number and e-mail address), communication data (e.g. correspondence by e-mail) and, if applicable, location data (IP address).

The legal basis for this processing of your personal data is Art. 6 para. 1 lit. a GDPR (your consent) and lit. b GDPR (pre-contractual measures, performance of contract) if we receive the data directly from you or enter into a direct contractual relationship with you.

If you are not an existing or potential business partner yourself, we have usually received your contact details from our business partner who has named you as a contact person. In this case, the processing of your data is based on Art. 6 para. 1 lit. f GDPR (balancing of interests, based on our legitimate interest in contacting existing or potential business partners).

The provision of personal data about you for the purpose of contacting you in the context of a business relationship is on a voluntary basis. Insofar as your contact data is absolutely necessary for the initiation and fulfilment of a contract, you must disclose your contact data, otherwise the contract with you cannot be concluded.

1.2 Establishing contact within the framework of our public relations work

We also maintain databases with contact details of political, media and press representatives, among others, in order to be able to contact them on relevant issues, events, etc. as part of our public relations work.

The processing of your personal data is based on your consent (Article 6 paragraph 1 lit. a GDPR), which you can give to us in personal contact (e.g. by handing over your business card or via online form). For your right to withdraw consent, please see point 5.8.

We also collect contact details from public sources and enter them in our databases. The legal basis for the data processing described is Art. 6 para. 1 lit. f GDPR. (Weighing of interests, based on our legitimate interest in contacting political, media and press representatives, among others, as part of our public relations work).

2. Recipients of personal data

As a general rule, your data collected by us will not be disclosed to unauthorised persons.

However, in some cases we use service providers to process personal data, including for sending emails, chats and video telephony. Your data (contact data, communication data, location data (IP address) is stored in a secure data center and databases.

All service providers have been carefully selected and are subject to data protection agreements with us. The service providers are only given access to your data to the extent and for the period required to provide the services or to the extent that you have consented to the data processing and use.

We also use service providers located in third countries outside the European Union to process your data. Countries outside the European Union handle the protection of personal data differently than countries within the European Union. There is currently no decision by the EU Commission that these third countries generally offer an adequate level of protection. We have therefore taken special measures to ensure that your data is processed in the third countries as securely as within the European Union. With service providers in third countries, we conclude the data protection contract (standard contractual clauses) provided by the Commission of the European Union for the processing of personal data in third countries or implement other permissible guarantees or legally permissible exceptions from Art. 49 GDPR. This provides appropriate safeguards for the protection of your data with service providers in the third country. You can request a copy of these guarantees using the contact details above.

3. Storage period; deletion periods

We store the data processed by you for as long as it is required to achieve the purpose and a legal basis exists. When this ceases to apply, your data will generally be deleted within 3 months. In addition, your data will be stored/not deleted for as long as contractual or statutory retention periods exist for them. To comply with legal requirements in the UK this would amount to a maximum of 7 years.

4. Automated decision-making; profiling

We do not use your personal data for automated decision-making or profiling.

5. Your data subject rights

Insofar as Kuoni processes your personal data, you as the data subject are entitled to the following data subject rights, subject to the requirements of data protection law.

5.1 Information

You can request information about your personal data processed by us (Art. 15 GDPR).

5.2 Correction

If your information is not (or no longer) accurate, you can request that your data be corrected. If your data is incomplete, you can request that it be completed (Art. 16 GDPR).

5.3 Deletion

You have the right to request the deletion of your data. Please note that a right to erasure depends on the existence of a legitimate purpose. In addition, there must be no regulations that oblige us to retain your data (Art. 17 GDPR).

5.4 Restriction of processing

You have the right to request the restriction of the processing of your data. Please note that a claim to restriction of processing depends on the existence of a legitimate purpose (Art. 18 GDPR).

5.5 Objection

If data is collected on the basis of Art. 6(1)(f) GDPR (data processing to protect overriding legitimate interests), you have the right to object to the processing of your data on grounds relating to your particular situation. In the event of an objection, we will no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is for the assertion, exercise or defence of legal claims (Art. 21 GDPR).

5.6 Right of appeal

You have the right to lodge a complaint with the Information Commissioner’s Office (https://ico.org.uk/) if you do not agree with the processing of your data (Art. 77 GDPR).

5.7 Data portability

You have the right to receive personal data that you have provided to us in an electronic format (Art. 20 GDPR).

5.8 Revocation of your consent

You have the right to revoke consent (Art. 6(1)(a) GDPR) to the processing of your data which you have given to us at any time. Your personal data will be deleted on the basis of your consent as soon as the purpose has been fulfilled or until revocation and when prior-rating retention periods have expired.

The easiest way to revoke consent you have given is to send an email to the contact details below. The revocation of consent does not affect the lawfulness of the processing of your data carried out until the revocation.

6. Contact details of the data protection officer

            Data protection officer

            DPO@kuoni.co.uk