-
Privacy Statement
Privacy statement for the use of cloopio
These are the data protection notices of “cloopio”, which is operated by Lufthansa Innovation Hub GmbH. Please contact us if you have any kind of question about the topic of data protection.
You can contact us at any time on all topics concerning data protection and exercising your rights:
datenschutz@lh-innovationhub.com
Lufthansa Innovation Hub GmbH
Brunnenstr. 19-21
10119 Berlin
Germany
You can contact our data protection officer on all issues related to the fulfillment of individual rights:
datenschutz@dlh.de
Deutsche Lufthansa AG
Group Privacy Officer - FRA CJ/D
Airportring - LAC
60546 Frankfurt
Germany
Use of the mediation services offered on our website
The purpose of this website is to provide information on mediated team offsites and enable visitors to request a mediation offer for displayed accommodations.
Processing of customer data via Google Sheets
When you want to send us a booking request, we need all the information marked as mandatory, otherwise we don’t have enough information to send you an offer (see sect. Sending booking requests via Typeform). After sending the booking request, we keep all your customer data in a Google Sheet to process it to provide our service. The legal basis for the processing of mandatory personal data is Art. 6 sect. 1 lit. b GDPR. Google Sheet is a service operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. You can find more information on Google’s privacy policy here: https://policies.google.com/privacy. If you contact us by email regarding your booking request, we will process your email address and the content of the email. We keep email communication for 12 months, unless statutory retention periods apply. In this case, we keep the email communication for 6 or 10 years in accordance with the law. Your data will be deleted or (if we are obliged to retain them due to legal conditions or contractual agreements) blocked as soon as the purpose of the data transfer has been fulfilled or if you inform us of your wish to do so.
Accommodation & service providers
After you have requested an offsite package, we share company name, group size, requested offsite dates and other requested services with our accommodation and service providers (such as activity, catering, transfer). After confirming availability and prices, we will send you an offer. If you confirm the offer, we will also share the following customer data with the accommodation and service providers: full name of the contact person from the company, telephone number and email address. The processing will be based on Art. 6 sect. 1 lit. f GDPR and serves the customer's interest to clarify final offsite details with the accommodation and service providers themselves, such as check-in and -out times or food options. Your data will be deleted or (if we are obliged to retain them due to legal conditions or contractual agreements) blocked as soon as the purpose of the data transfer has been fulfilled or if you inform us of your wish to do so.
Website usage analysis via Google Analytics
The website uses functions of Google Analytics. The service is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics is a tool for analyzing websites. We use Google Analytics to collect aggregated, anonymous data. This data allows us to understand how customers use the cloopio website and identify opportunities for improvement. In addition, the data performs important platform functions such as detecting errors and fraudulent usage, and it provides operational data. We use this information to improve the quality, effectiveness, and performance of our platforms so that you can get the most out of them. The Google Analytics script is used to collect this information. In order for this to work, Google Analytics sets cookies on your computer. Google is not authorized to access this data. Google Analytics anonymizes your IP address to protect your data. No other personal data is collected that would allow identification. Google Analytics is used only after your consent (Art. 6 sect. 1 lit. a DSGVO) and the setting can be changed at any time. You can find Google's data policies at http://www.google.com/privacy/. The data collected by Google Analytics may be stored and processed in the USA or in any country in which Google is active or subcontractors of Google maintain facilities. However, the IP mask method used by us ensures that the IP address is shortened within EU member states or in other EEA member states before it is transmitted to a Google server in the USA and stored there. Only in exceptional cases is the complete, i.e. unabbreviated, IP address transmitted to a Google server in the USA and only shortened there. For a data transfer to a third country, i.e. a country outside the EU or the EEA, appropriate guarantees for the protection of your personal data are generally required. Therefore, data transfer to the USA or other third countries without an adequate level of data protection only takes place on the basis of standard data protection contracts (SCC) to ensure adequate protection of your personal data.
You can prevent the recording and processing of your data by Google by downloading and installing the browser plugin available under the following link: https://tools.google.com/dlpage/gaoptout?hl=en.
Ad performance analytics with Google Ads
To measure the success of ads that we place with Google (“Google Ads”, formerly called “Google Adwords”), we use Google Conversion Tracking, an analysis service of Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Ads places a “conversion cookie” on your computer if you reach our website via a Google ad. These cookies expire after 30 days and cannot be used to personally identify you. They merely register the fact that you have clicked on one of our ads and consequently been redirected to our website. This tells us the total number of users that have clicked on an ad of ours and been routed to our website. We do not receive any information that could be used to personally identify users. This analysis tool is used on the basis of your consent (Art. 6 Sect. 1 lit. a GDPR).
The personal data that Google captures in this way are also stored and processed on servers in the United States. Data transmission to the US is based on the Standard Contractual Clauses (SCC) of the European Commission. Details can be found here: https://privacy.google.com/businesses/controllerterms/mccs/.
For more information on data protection at Google, see https://policies.google.com/privacy?gl=de&hl=en.
If you do not wish to participate in this tracking process, you can disable it at https://adssettings.google.com/authenticated. You can also disable cookies for conversion tracking by setting your browser to block cookies of the “googleadservices.com” domain.
Ad performance analytics with LinkedIn Insight Tag
Our website uses the LinkedIn Insight Tag conversion tool by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland (hereinafter LinkedIn) in cooperation with the parent company LinkedIn Corporation, 1000 W. Maude Avenue, Sunnyvale, CA 94085, USA.
This tool creates a cookie in your web browser to allow collection of data such as the following:
URLs and viewed pages
Referrer URL
IP address
Device and browser properties (user agent)
Time stamp
These data are collected by LinkedIn, encrypted, anonymized or pseudonymized, and deleted after a short time. LinkedIn does not share any personal data with us, but only offers anonymized reports on the website target group (demographic data) and ad performance. In addition, LinkedIn offers re-targeting for website visitors via the Insight tag.
We use these data to display targeted advertising, also outside our own website, without you being identified as a website visitor. This way, we are able to provide relevant content for our audiences. The legal basis for this is your consent to the use of cookies during collection of your data, Article 6, Paragraph 1, Clause 1 a) GDPR. Because anonymised reports and demographic data received by us have no impact on personal data, no justification based on data protection laws is required.
More information about the LinkedIn Insight tag can be found here: https://www.linkedin.com/help/linkedin/answer/a427660?lang=en
The data privacy policy of LinkedIn also provides more information about data collection and use, as well as options and rights to protect your privacy: https://www.linkedin.com/legal/privacy-policy?
If you are logged in at LinkedIn, you can deactivate data collection at any time. You will find instructions:https://www.linkedin.com/help/linkedin/answer/1569/ihre-konto-und-datenschutzeinstellungen-verwalten-ubersicht?lang=en
If you want to remove the LinkedIn Insight tag at our website, deactivate the Marketing field in our cookie settings.
Your data is collected by LinkedIn, and processed and deleted in accordance with the information it has provided (https://www.linkedin.com/legal/privacy-policy?).
Cookie-Banner via Cookiefirst
On our site, we use the service COOKIEFIRST of the company Digital Data Solutions B.V., Plantage Middenlaan 42a, 1018DH Amsterdam, The Netherlands, website: https://cookiefirst.com/. The transmission and processing of personal data takes place exclusively on servers in the European Union. The legal basis for the transmission and processing is Art. 6 Para. 1 lit. c) GDPR. The use of the service supports us in meeting our legal obligations. By integrating COOKIEFIRST, we fulfill our legal obligation with regard to the consent management required for cookies. For this purpose, we store information on the extent to which the user has confirmed the use of cookies. The user's decision can be revoked at any time by calling up the setting for cookies and managing the declaration of consent. Existing cookies are deleted after revocation of consent. A cookie is also set to store information about the status of the user's consent, which is referred to in the cookie details. Furthermore, the IP address of the respective user is transmitted to Digital Data Solution servers when this service is called up. The IP address is neither stored nor associated with any other data of the user, it is only used for the correct execution of the service. You can find out what rights you have in relation to the processing at the end of this privacy notice. For more information on the handling of transmitted data, please refer to the provider's privacy policy at https://cookiefirst.com/legal/privacy-policy/
Website Usage Analytics via Hotjar
If you have given your consent to cookies, we use Hotjar in order to better understand our users' needs and to optimize our service and users' experience. This is provided by Hotjar Ltd, Level 2, St Julians Business Center, 3, Elia Zammit Street, St Julians STJ 1000, Malta, Europe.
Hotjar is a technology service that helps us better understand our users' experience (e.g. how much time they spend on which pages, which links they choose to click, what users do and don't like, etc.) and this enables us to build and maintain our service by means of user feedback. Hotjar uses cookies and other technologies to collect data on our users' behavior and their devices (in particular the IP address of the device (captured and stored only in anonymized form), device screen size, device type (unique device identifiers), browser information, geographic location (country only), preferred language used to display our website). Hotjar stores this information in a pseudonymized user profile. Neither Hotjar nor we will ever use this information to identify individual users or to match it with further data on an individual user. For further details, please see Hotjar's Privacy Policy.
If you do not want to be recorded by Hotjar, you can disable it by setting the DoNotTrack header in your browser. For more information and more about Hotjar's data processing, please visit: www.hotjar.com/legal/compliance/opt-out.
Schedule a call via Calendly
We offer the users the possibility to schedule a meeting with us through “calendly”. This is provided by Calendly LCC, 88 N Avondale Road #603, Avondale Estates, GA 30002. The user is forwarded to the calendly website, where the user is asked to enter their name and email address. This means that calendly processes your data. This tool is used on the basis of Art. 6 Sect. 1 lit. b GDPR. You can revoke this permission at any time. For more details on the Privacy Policy of calendly, follow this link: https://calendly.com/privacy
Map visualization via Mapbox
In order to display maps on the venue detail page, we integrate the service provided by Mapbox Inc.,740 15th St Nw 5th Floor Washington, DC 20005 United States. To transmit the map to you and display it on your screen, the service provider receives your IP address. This is done on the basis of our legitimate interest in providing you with a pleasant user experience and visualizing the location of the accommodation. The IP address is transmitted to the service provider on demand when you call up the map, and is not permanently stored.
Sending booking requests via Typeform
In order to send us booking requests, we integrate the service provider Typeform SL, Pallars 108 (Attico - Typeform), 08018 - Barcelona (Spain). This tool is used on the basis of Art. 6 sect. 1 lit. b GDPR. For more details on the privacy policy of Typeform, follow this link: https://admin.typeform.com/to/dwk6gt. Within an on our website embedded form, the user is asked to enter personal information which will then be processed by us. Some of the information is required, such as your contact details, your company address, your job title and other offsite related information (depending on whether you have requested an offsite package or a customized offsite). If you contact us by email regarding your booking request, we will process your email address and the content of the email. We keep email communication for 12 months, unless statutory retention periods apply. In this case, we keep the email communication for 6 or 10 years in accordance with the law. Your data will be deleted or (if we are obliged to retain them due to legal conditions or contractual agreements) blocked as soon as the purpose of the data transfer has been fulfilled or if you inform us of your wish to do so.
E-mail communication via SendGrid
We process your email address in order to provide automatic confirmations of your requests or links to confirm your account or reset your password. The legal basis for that is Article 6 (1) (b) of the GDPR. You can stop the sending of confirmation emails at any time via the “unsubscribe” button in every email. The emails are sent by our service provider SendGrid which is operated by Twilio Germany GmbH, Rosenheimer Str. 143C, 81671 Munich. We keep email communication for 12 months, unless statutory retention periods apply. In this case, we keep the email communication for 6 or 10 years in accordance with the law. If you have an account, we will store your email address until your account is deleted.
Marketing email communication via Mailchimp
Based on your consent, we process your email address in order to provide you with information and news about the service. The legal basis for that is Art. 6 sect. 1 lit. a GDPR. You can stop the sending of marketing emails at any time via the “unsubscribe” button in every email. The emails are sent by our service provider Mailchimp which is operated by the Rocket Science Group LLC d/b/a Mailchimp, 675 Ponce De Leon Avenue, Northeast Suite 5000 Atlanta, GA 30308, USA. Your email address will be stored until you request to unsubscribe or to delete your user account. For more information on the privacy policy of Mailchimp, follow this link: https://www.intuit.com/privacy/statement/.
Email communication via Google
If you contact us by e-mail your request, including all resulting personal data (name, request) will be stored and processed by us for the purpose of processing your request. We do not pass these data on without your consent. These data are processed on the basis of Art. 6(1)(b) GDPR. The data sent by you to us via contact requests remain with us until you request us to delete, revoke your consent to the storage or the purpose for the data storage lapses (e.g. after completion of your request). Mandatory statutory provisions - in particular statutory retention periods - remain unaffected.
Website hosting via Vercel
We collect the following data in so-called log files that your browser transmits: IP address, date and time of the request, time zone difference to Greenwich Mean Time, content of the request, HTTP status code, amount of data transferred, website from which the request came and information about the browser and operating system. This is necessary to display our website and to ensure stability and security. This corresponds to our legitimate interest within the meaning of Art. 6 para. 1 p. 1 lit. f GDPR. The cloopio website is hosted with Vercel Inc., 650 California St, San Francisco, California, 94108, United States. This is the recipient of your personal data and acts as a processor for us. This corresponds to our legitimate interest within the meaning of Art. 6 (1) p. 1 lit. f GDPR not to have to maintain a server on our premises ourselves. You can learn more about Vercel’s privacy policy here. You have the right to object to the processing. Whether the objection is successful is to be determined within the framework of a balancing of interests. Vercel stores your data as long as they have an ongoing legitimate business need to process your personal information. As soon as this is not given, Vercel will either delete or anonymize it or, if this is not possible (for example, because your personal information has been stored in backup archives), Vercel will securely store your personal information and isolate it from any further processing until deletion is possible. The processing of the data provided under this section is not required by law or contract. The functionality of the website is not guaranteed without the processing.
[SSL/TLS Encryption]
Our website uses SSL or TLS encryption for security reasons and to protect the transmission of confidential content, such as contact requests that you send to us as the site operator. You can recognise an encrypted connection by the fact that the address line of your browser changes from “http://” to “https://” and by the lock symbol in your browser line.
Rights of the data subject and right of appeal
It is an important concern for Lufthansa Innovation Hub to ensure that our processing procedures are fair and transparent. They are entitled to the following rights:
Right of access
On request, you have the right to obtain information from us about the personal data concerning you and processed by us, to the extent defined in Art. 15 GDPR. You can send your request either by mail or email to the addresses given above.
Right to rectification
You have the right to require us to rectify any inaccurate personal data concerning you without undue delay (Art. 16 GDPR). For this purpose, please contact the address given above.
Right to deletion
Where the legal reasons defined in Art. 17 GDPR apply, you have the right to immediate deletion (“right to be forgotten”) of personal data concerning you. These legal reasons include: the personal data are no longer necessary for the purposes for which they were processed, or you withdraw your consent, and there are no other legal grounds for processing; the data subject objects to the processing (and there are no overriding legitimate grounds for processing––does not apply to objections to direct advertising). To assert your above right, please contact the contact address given above.
Right to restriction of processing
If the criteria defined in Art. 18 GDPR are fulfilled, you have the right to restriction of processing as established in the above article of the GDPR. According to this article, restriction of processing may be called for in particular if processing is unlawful and the data subject opposes deletion of the personal data and requests the restriction of their use instead, or if the data subject has objected to processing according to Art. 21 (1) GDPR as long as it is unclear whether our legitimate interest overrides the interest of the data subject. To assert your above right, please contact the contact address given above.
Right to data portability
You have the right to data portability as defined in Art. 20 GDPR. This means you have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format, and have the right to transmit those data to another controller, such as another service provider. Prerequisite is that processing is based on consent or a contract and is carried out using automated means. To assert your above right, please contact the contact address given above.
Right to object
You have the right to object at any time under Art. 21 GDPR to processing of personal data concerning you which is based on Art 6 (1) lit. e or f GDPR, on grounds relating to your particular situation. We will desist from processing your personal data unless we can demonstrate compelling legitimate grounds for processing which override your interests, rights, and freedoms, or unless processing is for the establishment, exercise, or defence of legal claims. To assert your above right, please contact the contact address given above.
Right to file a complaint with a supervisory authority
If you think that processing of personal data concerning you and carried out by us is unlawful or impermissible, you have the right to file a complaint with the supervisory authority responsible for us. You can contact this authority at:
Berliner Beauftragte für Datenschutz und Informationsfreiheit
Friedrichstr. 219
10969 Berlin
Tel.: +49 30 13889-0
Fax: +49 30 2155050
Email: mailbox@datenschutz-berlin.de
If you have given us permission to process your personal data, we hereby inform you that you can revoke this permission at any time. To exercise your rights, you can contact us by e-mail at datenschutz@lh-innovationhub.com.
End of privacy statement