LUDOVICO Cooperative LVC, Zur Schule 3, 9494 Schaan, Principality of Liechtenstein
Types of processed data:
☒ Inventory data
☒ contact information
☒ content data
☒ contract data
☒ Payment data
☒ Usage data
☒ Meta / communication data
Processing of special categories of data (Article 9 (1) GDPR):
☒ Special categories of data have been processed in connection with the booking of holiday real estate that has been processed by users for the legitimization tests (identity document data) required for the overnight stays. In addition, we learn information about holiday destinations, locations and equipment of holiday properties, which are particularly popular with those interested, as well as information about the people accompanying them as well as children. Also information on preferences with drinks and food as well as popular leisure activities an
d excursion destinations are z.T. be learned.
Categories of data subjects:
☒ Customers / prospects / suppliers.
☒ Visitors and users of the online offer. In the following, we also refer to the persons concerned as “users”.
Purpose of processing:
☒ Providing the online offer, its contents and functions.
☒ Provision of contractual services, service and customer care.
☒ Answering contact requests and communicating with users.
☒ Marketing, Advertising and Market Research.
☒ security measures.
As of: 24.05.2018
- Relevant legal bases
In accordance with Art. 13 GDPR, we inform you about the legal basis of our data processing. Unless the legal basis in the data protection declaration is mentioned, the following applies: The legal basis for obtaining consent is Article 6 (1) lit. a and Art. 7 GDPR, the legal basis for the processing for the performance of our services and the execution of contractual measures as well as the response to inquiries is Art. 6 (1) lit. b GDPR, the legal basis for processing in order to fulfill our legal obligations is Art. 6 (1) lit. c GDPR, and the legal basis for processing in order to safeguard our legitimate interests is Article 6 (1) lit. f GDPR. In the event that vital interests of the data subject or another natural person require the processing of personal data, Art. 6 para. 1 lit. d GDPR as legal basis.
- Safety measures
3.1. We take appropriate technical measures in accordance with Art. 32 GDPR, taking into account the state of the art, the implementation costs and the nature, scope, circumstances and purposes of the processing as well as the different likelihood and severity of the risk to the rights and freedoms of natural persons and organizational measures to ensure a level of protection appropriate to the risk; Measures include, in particular, ensuring the confidentiality, integrity and availability of data by controlling physical access to the data, as well as their access, input, disclosure, availability and separation. In addition, we have established procedures that ensure the enjoyment of data subject rights, data erasure and data vulnerability. Furthermore, we consider the protection of personal data already in the development, or selection of hardware, software and procedures, according to the principle of data protection by technology design and by privacy-friendly default settings taken into account (Article 25 GDPR). 3.2. One of the security measures is the encrypted transfer of data between your browser and our server.
- Cooperation with contract processors and third parties
4.1. If, in the context of our processing, we disclose data to other persons and companies (contract processors or third parties), transmit them to them or otherwise grant access to the data, this will only be done on the basis of a legal permission (eg if a transmission of the data to third parties, as required by payment service providers, pursuant to Art. 6 (1) (b) GDPR to fulfill the contract), you have consented to a legal obligation or based on our legitimate interests (eg the use of agents, webhosters, etc.). 4.2. If we commission third parties to process data on the basis of a so-called “contract processing contract”, this is done on the basis of Art. 28 GDPR.
- Transfers to third countries
If we process data in a third country (ie outside the European Union (EU) or the European Economic Area (EEA)) or in the context of the use of third party services or disclosure or transmission of data to third parties, this will only be done if it is to fulfill our (pre) contractual obligations, on the basis of your consent, on the basis of a legal obligation or on the basis of our legitimate interests. Subject to legal or contractual permissions, we process or have the data processed in a third country only in the presence of the special conditions of Art. 44 et seq. GDPR. That the processing is e.g. on the basis of specific guarantees, such as the officially recognized level of data protection (eg for the US through the Privacy Shield) or compliance with officially recognized special contractual obligations (so-called “standard contractual clauses”).
- Rights of the persons concerned
6.1. You have the right to ask for confirmation as to whether the data in question is being processed and for information about this data as well as for further information and a copy of the data in accordance with Art. 15 GDPR. 6.2. You have accordingly. Art. 16 GDPR the right to demand the completion of the data concerning you or the correction of the incorrect data concerning you. 6.3. In accordance with Art. 17 GDPR, they have the right to demand that the relevant data be deleted immediately or, alternatively, to require a restriction of the processing of data in accordance with Art. 18 GDPR. 6.4. You have the right to demand that the data relating to you, which you have provided to us, be obtained in accordance with Art. 20 GDPR and request their transmission to other persons responsible. 6.5. You have gem. Art. 77 GDPR the right to file a complaint with the competent supervisory authority.
You have the right to grant consent in accordance with. Art. 7 para. 3 GDPR with effect for the future.
- Right to
You can object to the future processing of your data in accordance with Art. 21 GDPR at any time. The objection may in particular be made against processing for direct marketing purposes.
- Cookies and Right to Oppose Direct Mail
- Deletion of data
- Provision of contractual services
11.1. We process inventory data (e.g., names and addresses as well as contact information of users), contract data (e.g., services used, names of contacts, payment information) for the purpose of fulfilling our contractual obligations and services in accordance with Art. Art. 6 para. 1 lit b. GDPR. The entries marked as obligatory in online forms are required for the conclusion of the contract. 11.2. Users can optionally create a user account, in particular by being able to view their orders. As part of the registration, the necessary mandatory information will be communicated to the users. The user accounts are not public and can not be indexed by search engines. If users have terminated their user account, their data will be deleted with regard to the user account, subject to their retention is for commercial or tax law reasons according to Art. 6 para. 1 lit. c GDPR necessary. It is the responsibility of the users to secure their data upon termination before the end of the contract. We are entitled to irretrievably delete all user data stored during the term of the contract. 11.3. As part of the registration and re-registration as well as use of our online services, the IP address and the time of the respective user action will be saved. The storage is based on our legitimate interests, as well as the user’s protection against misuse and other unauthorized use. A transfer of these data to third parties does not take place, unless it is necessary for the prosecution of our claims or there is a legal obligation in accordance with. Art. 6 para. 1 lit. c GDPR. 11.4. We process usage data (e.g., the visited web pages of our online offering, interest in our products) and content data (e.g., entries in the contact form or user profile) for advertising purposes in a user profile to inform the user e.g. To display product instructions based on their previously used services. 11.5. The deletion takes place after expiry of legal warranty and comparable obligations, the necessity of keeping the data is checked every three years; in the case of legal archiving obligations, the deletion takes place after its expiry of the 10-year retention period; Information in the customer account remains until its deletion.
12.1. When contacting us (via contact form or e-mail), the information provided by the user to process the contact request and its processing acc. Art. 6 para. 1 lit. b) GDPR processed. 12.2. User information can be stored in our Customer Relationship Management System (“CRM System”) or similar request organization. 12.3. We expect to use the CRM system Agile CRM. We have concluded an order data contract (Data Processing Agreement). Agile has applied for inclusion in the Privacy Shield USA. As long as the membership is not documented, we will not send any data to it. 12.4. We delete the requests, if they are no longer required. We check the necessity every two years; Inquiries from customers who have a customer account, we store permanently and refer to the deletion on the details of the customer account. In the case of legal archiving obligations, the deletion takes place after its expiration of the (10 years) storage obligation.
- Comments and posts
13.1. If users leave comments or other contributions, their IP addresses are based on our legitimate interests within the meaning of Art. 6 para. 1 lit. f. GDPR stored for 7 days. 13.2. This is for our own safety, if someone leaves illegal content in comments and contributions (insults, prohibited political propaganda, etc.). In this case, we ourselves can be prosecuted for the comment or post and are therefore interested in the identity of the author.
- Fetch profile pictures at Gravatar
We may use the service Gravatar, Automattic, Inc. 132 Hawthorne Street San Francisco, CA 94107, USA, within our online offering and, in particular, the blog. Gravatar is a service that allows users to log in and submit profile pictures and their email addresses. If users with the respective e-mail address on other online sites (especially in blogs) leave posts or comments, so their profile pictures can be displayed next to the posts or comments. For this purpose, the e-mail address communicated by the users to Gravatar is transmitted encrypted in order to check whether a profile is stored for it. This is the sole purpose of sending the e-mail address and it will not be used for other purposes, but will be deleted afterwards. The use of Gravatar is based on our legitimate interests within the meaning of Art. 6 para. 1 lit. f) GDPR, because with the help of Gravatar we offer the post and comment writers the opportunity to personalize their posts with a profile picture. Automattic is certified under the Privacy Shield Agreement, which provides a guarantee to comply with European privacy legislation (https://www.privacyshield.gov/participant?id=a2zt0000000CbqcAAC&status=Active). By displaying the images, Gravatar has learned the IP address of the users, as this is necessary for communication between a browser and an online service. For more information about Gravatar’s collection and use of data, see the Automattic Privacy Notice: https://automattic.com/privacy/. If users do not want a user picture linked to their email address on Gravatar to appear in the comments, they should use a non-Gravatar email address to comment. We also point out that it is also possible to use an anonymous or even no e-mail address if the users do not want their own e-mail address to be sent to Gravatar. Users can completely prevent the transfer of data by not using our commenting system.
15.1. Our web host is the CYON GmbH, Basel. The web host is used to host the website, to operate via CMS WordPress, to manage the mailboxes as well as databases with customer and contract data. All data entered on the website, so all electronic correspondence is there. 15.2. It was concluded with Cyon a corresponding order processing contract (or “Data Processing Agreement”). This is required by law, because the hoster collects personal data of the website visitors.
- Collection of access data and logfiles
16.1. Based on our legitimate interests within the meaning of Art. 6 para. 1 lit. f. GDPR Data on every access to the server on which this service is located (so-called server log files). The access data includes name of the retrieved web page, file, date and time of retrieval, amount of data transferred, message about successful retrieval, browser type and version, the user’s operating system, referrer URL (the previously visited page), IP address and the requesting provider , 16.2. Logfile information is stored for security purposes (for example, to investigate abusive or fraudulent activities) for a maximum of seven days and then deleted. Data whose further retention is required for evidential purposes shall be exempted from the cancellation until final clarification of the incident.
- Online presence in social media
- Cookies & reach measurement
- Google Analytics
- Google Re / marketing services
- Facebook social plugins
- Integration of services and content of third parties
Data exchange with cooperation partners
We cooperate with various estates and distribution partners. We exchange information with other partners regarding confidentiality.