Berlin, May 2018
As part of our business and the service that we provide, it is necessary to process information about you.
We attach great importance to respect your privacy, the security and the confidentiality of your personal data.
Therefore, we are committed to treating your personal data in compliance European regulations on the protection of personal data, namely: The Data Protection Act 2018 (DPA) and General Data Protection Regulation (GDPR) (hereafter referred to as “the Regulations”).
We invite you to read these documents carefully.
For the purposes of the Regulations, we VRealTechnologies Gmbh – trading as TimeRiftTours.com – of Cotheniusstrasse 4, Berlin, 10407, are the data controller & processor.
The personal data that we may deal with comes from:
These cookies and other trackers record and transmit information about the pages you visit, the time you spend on our site, the actions you perform there, etc.
This includes the data that we receive from our partners when you use to their services through our Site (for example, when using the payments service through our Site).
We process the following:
We do not handle sensitive data to data about you (on your religion, your political opinions, your health, your union membership, etc.).
We collect and process your personal data for the purpose of:
The processing of your data is based on our legitimate interest to run, improve and optimise our service for you. This is based on the contract between you and our company, through the Terms and Conditions.
However, in the following cases, the processing of your data is based on your specific consent (which will be collected through the checkbox on our registration/account settings page or a positive action on your part):
We will make sure to consider your application as soon as possible and to inform recipients of your data.
We are committed to protecting the privacy of children aged 16 or under. If you are aged 16 or under, please get your parent’s or guardian’s permission beforehand whenever you provide us with personal information.
We are responsible for the processing of your personal data.In the case of a tour reservation we have to hand over some of your personal data to our trusted tour guide partners in order to organise your tour. This data includes, name and contact information, group size, time a date of proposed tour and any other information your share with us through the booking form.
The recipients of this data include:
The use of personal data by third parties to our business is governed by their own privacy policies. Please be assured we will not release your information to third parties for them to use for their own direct marketing purposes, unless you have requested us to do so.
Your data is handled within the European Union.
However, when our relations with partners, subcontractors or third parties (such as suppliers who provide us with support services) involve border exchange of personal data outside the European Union, we ensure that these transfers are made to countries with an adequate level of protection, or are supervised by legal tools to ensure such transfers a level of protection complies with European requirements (such as contractual clauses Types of the European Commission, the internal rules company and / or the adhesion of entities recipients of these data to Privacy Shield, when located in the United States).
If you use our services while you are outside the EU, your information may be transferred outside the EU in order to provide you with those services.
In any event, you agree to your personal data being processed under these conditions, outside the European Union.
Security is at the heart of our concerns.
We implement appropriate technical and organisational measures, including physical, hardware and software, in order to preserve the security, integrity and confidentiality of your personal data and protect against unauthorised access, use, misuse, alteration, disclosure or destruction by unauthorised persons.
We demand sufficient guarantees of security and confidentiality from the recipients of data.
Furthermore, we encourage you to notify us of any security breach capable of generating a breach to your rights and freedoms, unless such communication is not necessary in cases referred to in Article 34 of the Regulations.
You are responsible for the confidentiality of any passwords you select and/or is assigned to you to in order to access certain features of the Site. You are not allowed to share the password with others.
Regarding data relating to the management of our customers:
The data of our customers will not be retained beyond the time strictly necessary to the management of the business relationship.
However, we will keep your data for analysis and statistics, for longer than the time required for the purpose of contract fulfilment, after having irreversibly anonymised this data.
After this period of three (3) years, we are committed to destroying your personal data.
Under the Regulations, you have, with regard to the processing of your personal data, a right of access, rectification, erasure, restriction, portability and a right to object.
Right of Information and Access
You have the right to obtain from us confirmation as to whether or not your personal data is being processed; where it is; access to the personal data and the following information:
Right to Rectification
As a Data Subject you have the right to obtain, without undue delay, the rectification of inaccurate personal data concerning them from the Data Controller.
Subject to the purposes for processing, data subjects have the right to have incomplete data completed, including by means of providing a supplementary statement.
Right to Erasure (‘Right to be Forgotten’)
A Data Subject has the right to obtain from the Data Controller the erasure of personal data concerning them, without undue delay and the controller is obliged to erase that data where one of the following grounds applies:
Where the Data Controller has made the personal data public and is obliged to erase the personal data, the data controller, taking account of available technology and the cost of implementation, must take reasonable steps to inform data controllers processing the personal data that the data subject has requested erasure. Personal data does not require to be erased where processing is necessary:
Right to Restriction of Processing
Data Subjects have the right to restrict a Data Controller’s processing of their personal data where:
Right to Portability
Data subjects have the right to receive their personal data (where they have provided it to the Data Controller), in a structured, commonly used and machine-readable format and to have the data transmitted to another data controller without hindrance, where:
This right is dependent on the transfer between the Data Controller and the data subject being technically feasible.
The right will not apply to processing necessary for the performance of a task carried out in the public interest, or in the exercise of official authority vested in the controller.
This right cannot be exercised if it will adversely affect the rights and freedoms of others.
Finally, you can, if necessary, ask for the deletion of your personal data that has been collected when you were a minor.
The exercise of these rights will be by sending us your request by email to the following address: email@example.com
To access your application, we will need to know your identity.
We will therefore seek a photocopy of one of your identity documents with your signature. We will retain this copy for the time required to process your request (subject to periods specifically mentioned in section 8 above).
You will also need to provide us with the address to which the reply should be sent to you.
Your application does not need to be justified, except in cases of exercise by you of the right to object. Indeed, in case of exercise of your right of objection, you must provide proof of the existence of a legitimate reason, except in the case where your data is processed for marketing purposes, including commercial.
For questions, please contact us by email at: firstname.lastname@example.org