Privacy

We take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and all other relevant data protection regulations as well as this privacy policy. As a rule, you can use our website without providing any personal data. Where personal data (such as name, address or email addresses) is collected on our pages, this is always done on a voluntary basis. This data will not be passed on to third parties without your express consent.

The controller responsible for data processing within the meaning of the GDPR, the BDSG and other data protection regulations is

Blitzstart GmbH
Maximiliansplatz 17
80333 Munich, Germany

Contact

Phone: +49 89 95 44 302 – 50
Fax: +49 89 95 44 302 – 55
Email: info@blitzstart.com

Pursuant to Art. 37 GDPR and Section 38 BDSG (new version), we are not obliged to appoint a data protection officer.

If you send us inquiries via the contact form, the information you provide in the inquiry form, including the contact details you provide there, will be stored by us for the purpose of processing the inquiry and in the event of follow-up questions. We do not pass on this data without your consent. The legal basis for processing your personal data in this case is the consent you have granted in conjunction with Art. 6 (1) (a) GDPR.

The provider of the website www.blitzstart.com automatically collects and stores information in so-called server log files, which your browser automatically transmits to us and which are stored temporarily.

These are:

• Browser type / browser version of the accessing system
• Operating system and version used by the accessing system
• Client version
• Target domain or the sub-pages of our website accessed by an accessing system
• The website from which an accessing system reaches our website (so-called referrer URL)
• Host name, IP address and internet service provider of the accessing system
• Method of access
• Date and time of the server request
• Volume of data transferred and access status

This log data is stored in a log file to ensure data security, but cannot be attributed to specific individuals. This data is not merged with other data sources, and no conclusions are drawn about the data subject. Rather, this data is required (1) to deliver the contents of our website correctly, (2) to optimize the contents of our website and the advertising for it, (3) to ensure the long-term functionality of our IT systems and the technology of our website, (4) to be able to trace inadmissible access attempts and accesses to the web server, and (5) to provide authorities and courts with the information necessary for criminal prosecution and the prevention of danger as well as for the pursuit of our legitimate interests and civil-law claims in the event of a cyberattack. We evaluate this anonymously collected data and information with the aim of increasing data protection and data security within our company. Any further use of the log data is carried out exclusively for statistical purposes in anonymized form. We reserve the right to review this data subsequently if we become aware of concrete indications of unlawful use. Otherwise, the log data is deleted at regular intervals – at the latest after 14 days. The legal basis for the data processing, insofar as personal data is involved at all, is in this case Art. 6 (1) (f) GDPR.

Cookies are small text files that your browser stores on your device. Without your consent, we store only what Section 25(2) No. 2 TDDDG allows as strictly necessary for the features you use:

• bs_cookie_consent stores your choice in the cookie banner so that we do not ask again on every visit. The cookie is kept for six months, after which we ask again.
• NEXT_LOCALE stores the language you chose until the end of your browser session.
• Your browser's session storage keeps a draft of what you enter in the inquiry form until you close the tab or send the inquiry.
• Your browser's local storage keeps your progress in the online reservation. We discard it 24 hours after your last change.

The legal basis for this processing is Art. 6(1)(f) GDPR. Our legitimate interest is that the website respects your choice and that input you have started is not lost.

We use all other cookies and similar technologies only if you have consented under Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. On your first visit, our cookie banner asks for your consent.

You can change your choice or withdraw your consent for the future at any time through the "Cookie settings" link in the footer of every page. After you withdraw it, we delete the cookies of the analytics services described below from your browser. If you do not consent, you can use the website without restrictions.

If you consent, we use Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics records which pages you view, how long you stay and which page you came from, along with details of your browser, operating system and device. Google Analytics also records how far you scroll, which external links and downloads you click and whether you fill in a form. Google links this data to a pseudonymous identifier.

We use the reports to improve our website and to measure how often visitors send an inquiry and open the online reservation. Google does not receive the content of your inquiry.

According to Google, Google Analytics does not store IP addresses. For visits from the EU, Google determines the approximate location on servers in the EU and then discards the IP address. We do not allow Google's advertising features. We have turned off Google Signals and the sharing of data with other Google services.

The legal basis is your consent under Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. Google processes the data on our behalf, under a data processing agreement we have concluded with Google pursuant to Art. 28 GDPR.

Google may transfer data to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework, and the European Commission has issued an adequacy decision under Art. 45 GDPR for companies certified under it. Our data processing agreement with Google also includes standard contractual clauses under Art. 46(2)(c) GDPR.

Google Analytics sets two cookies:

• _ga distinguishes visitors and is kept for up to two years after your last visit.
• _ga_<ID> keeps the state of the current session and is kept for up to two years after your last visit.

Google deletes event data linked to your identifier after 14 months.

You can withdraw your consent at any time via "Cookie settings" in the footer.

Google describes how it processes data in Google Analytics under Safeguarding your data (opens in new tab).

If you consent, we also use Contentsquare, provided by Contentsquare SAS, 7 rue de Madrid, 75008 Paris, France. Contentsquare records clicks, mouse movements, scrolling and the pages viewed, and turns them into heatmaps and recordings of individual sessions. We use them to find where our website is hard to use.

According to Contentsquare, text on the page and input in form fields is masked in your browser and never transmitted. Contentsquare always removes email addresses, phone numbers, card numbers and long sequences of digits. It uses the IP address only to determine an approximate location and to detect automated traffic, and deletes it after three days at the latest.

Contentsquare stores the data on servers in the EU. Some of Contentsquare's sub-processors may access it from countries outside the EU. Contentsquare bases such transfers on an adequacy decision of the European Commission under Art. 45 GDPR or on standard contractual clauses under Art. 46(2)(c) GDPR.

The legal basis is your consent under Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. Contentsquare processes the data on our behalf, under a data processing agreement we have concluded with Contentsquare pursuant to Art. 28 GDPR.

Contentsquare sets these cookies:

• _cs_id is a pseudonymous identifier for you as a visitor and is kept for up to 13 months after your last visit.
• _cs_s and _cs_s_ctx link your page views to the current session and are kept for 30 minutes.
• _cs_c and _cs_optout store the service's settings and are kept for up to 13 months.

Contentsquare deletes the collected data after [N] months.

You can withdraw your consent at any time via "Cookie settings" in the footer.

Contentsquare describes how it processes data about website visitors in its privacy policy (opens in new tab).

Your personal data will not be transferred to third parties for purposes other than those listed below. We only pass on your personal data to third parties if:

• you have given your express consent pursuant to Art. 6 (1) sentence 1 (a) GDPR,
• the disclosure pursuant to Art. 6 (1) sentence 1 (f) GDPR is necessary for the assertion, exercise or defense of legal claims and there is no reason to assume that you have an overriding interest worthy of protection in not disclosing your data,
• in the event that there is a legal obligation to disclose the data pursuant to Art. 6 (1) sentence 1 (c) GDPR, and
• this is legally permissible and necessary pursuant to Art. 6 (1) sentence 1 (b) GDPR for the performance of contractual relationships with you.

The controller processes and stores the personal data of the data subject only for the period necessary to achieve the purpose of storage, or where this has been provided for by the GDPR or another data protection regulation to which the controller is subject. If the purpose of storage no longer applies, or if a storage period prescribed by the GDPR or another applicable provision expires, the personal data is routinely blocked or deleted in accordance with the statutory provisions.

Processing of personal data beyond the purposes described in this privacy policy only takes place insofar as you provide us with this data voluntarily, for example when you contact us by email or transmit data to us via the contact form. The sections "Cookies and Consent Management", "Google Analytics" and "Contentsquare" list the cookies we use. Data is transferred to countries outside the European Union only through the services described in the sections "Google Analytics" and "Contentsquare", and only with your consent.

We do not make automated decisions under Art. 22 GDPR.

We point out that the transmission of data over the internet (e.g. when communicating by email) can have security gaps; complete protection of data against access by third parties is not possible.

Any person affected by the processing of personal data (hereinafter the „data subject") has the following rights granted by the GDPR:

a) Right to confirmation

Every data subject has the right to obtain from the controller confirmation as to whether personal data concerning them is being processed.

b) Right of access

Every data subject has the right to obtain from the controller, free of charge and at any time, information about the personal data stored concerning them, as well as a copy of this information. The data subject may also request information about the following: the purposes of the processing; the categories of personal data processed; the recipients or categories of recipients; the envisaged storage period or the criteria used to determine it; the existence of a right to rectification, erasure, restriction or objection; the existence of a right to lodge a complaint with a supervisory authority; all available information about the origin of the data, where it was not collected from the data subject; the existence of automated decision-making, including profiling, pursuant to Art. 22 (1) and (4) GDPR. Furthermore, the data subject has the right to be informed whether personal data has been transferred to a third country or to an international organisation, as well as about the appropriate safeguards relating to the transfer.

c) Right to rectification

Every data subject has the right to obtain the rectification without undue delay of inaccurate personal data concerning them. Furthermore, the data subject has the right, taking into account the purposes of the processing, to have incomplete personal data completed — including by means of providing a supplementary statement.

d) Right to erasure

Every data subject has the right to obtain from the controller the erasure of personal data concerning them without undue delay, where one of the grounds provided for by law applies (e.g. the purpose no longer applies, withdrawal of consent, objection, unlawful processing or a legal obligation to erase) and insofar as the processing is not necessary.

e) Right to restriction of processing

Every data subject has the right to obtain from the controller the restriction of processing where one of the statutory conditions is met (contesting the accuracy, unlawful processing where erasure is refused, the data subject's continued need for the data to defend legal claims, or a pending objection).

f) Right to data portability

Every data subject has the right to receive the personal data concerning them, which they have provided to the controller, in a structured, commonly used and machine-readable format, and to transmit this data to another controller, provided that the processing is based on consent (Art. 6 (1) (a) GDPR) or on a contract (Art. 6 (1) (b) GDPR) and is carried out by automated means.

g) Right to object

If we process personal data for the purpose of direct marketing, the data subject has the right to object at any time to the processing for the purposes of such marketing; we will then no longer process the personal data for these purposes. In addition, the data subject has the right, on grounds relating to their particular situation, to object to processing based on Art. 6 (1) (f) GDPR.

h) Right to withdraw consent under data protection law

Every data subject has the right to withdraw consent granted to the processing of personal data at any time, without giving reasons, in whole or in part, with effect for the future. The withdrawal does not affect the lawfulness of the processing carried out up to that point. The withdrawal can be made informally, in particular by post, fax or email to the contact details of the controller set out above.

To exercise the aforementioned rights, as well as for any questions regarding data protection, you can contact us at any time using the controller's contact details set out above. Without prejudice to any other legal remedy, every data subject also has the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The supervisory authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany.