Data Protection

1. Privacy at a Glance

General information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to personally identify you.

Who is responsible for data collection on this website?

Data processing on this website is carried out by the website operator. The operator’s contact details can be found in the section “Information on the Controller” in this Privacy Policy.

How do we collect your data?

Your data is collected when you provide it to us, for example by entering information into our contact form or by contacting us by email. Other technical data, such as your internet browser, operating system, or the time the website was accessed, is collected automatically when you visit this website in order to ensure the proper and secure operation of the website. No analysis for advertising, tracking, or marketing purposes takes place.

What rights do you have regarding your data?

You have the right at any time to obtain information free of charge about the origin, recipients, and purpose of your stored personal data. You also have the right to request the correction or deletion of this data and, under certain circumstances, the restriction of its processing. You also have the right to lodge a complaint with the competent supervisory authority. You can contact us at any time using the contact details provided in the Legal Notice.

2. Hosting

External hosting

This website is hosted by an external service provider. Personal data collected on this website is stored on the hosting provider’s servers. This may primarily include IP addresses, metadata and communication data, website access data, and other data generated through the use of a website.

External hosting is used for the purpose of fulfilling contracts with our prospective and existing customers (Art. 6(1)(b) GDPR) and in our legitimate interest in providing our online services securely, quickly, and efficiently through a professional service provider (Art. 6(1)(f) GDPR). Where we obtain consent, processing is additionally based on Art. 6(1)(a) GDPR.

Our hosting provider will process your data only to the extent necessary to fulfil its contractual obligations and will follow our instructions regarding such data. We have concluded a data processing agreement (DPA) with the provider.

We use the following hosting provider:

united-domains AG
Gautinger Straße 10
82319 Starnberg
Germany

3. General Information and Mandatory Disclosures

Data Protection

We treat your personal data confidentially and in accordance with applicable data protection laws and this Privacy Policy. Data transmission over the internet (e.g. by email) may be subject to security vulnerabilities. Complete protection against access by third parties is not possible.

Information on the Controller

FineArtTravel GmbH
Westpreußenstr. 15 A
21391 Reppenstedt
Germany

Phone: +49 4131 69 71 200
Email: info@finearttravel.de

Storage Period

Unless a more specific storage period is stated, your data will remain with us until the purpose for processing no longer applies. If you submit a legitimate request for deletion, your data will be deleted unless there are legally permissible reasons for continued storage, such as statutory retention obligations under tax or commercial law.

Legal Bases for Data Processing

Data processing on this website is based on Art. 6(1)(b) GDPR (performance of a contract or steps taken prior to entering into a contract) and Art. 6(1)(f) GDPR (legitimate interest in the secure and error-free provision of the website).

Data Transfers to Third Countries (e.g. the USA)

Cloudflare Inc. is certified under the EU-U.S. Data Privacy Framework. Transfers of data to the United States are therefore based on the adequacy decision of the European Commission.

Your Rights as a Data Subject

  • Right to object (Art. 21 GDPR): If data processing is based on Art. 6(1)(f) GDPR, you have the right to object to the processing at any time on grounds relating to your particular situation.
  • Withdrawal of consent: You may withdraw any consent you have voluntarily given at any time with effect for the future by email.
  • Access, rectification, erasure and restriction: You have the right to obtain information free of charge about your stored personal data and to request its rectification, erasure, or restriction of processing.
  • Data portability: You have the right to receive data that we process automatically on the basis of a contract or consent in a commonly used, machine-readable format.
  • Right to lodge a complaint: You have the right to lodge a complaint with the competent data protection supervisory authority.

SSL/TLS Encryption

For security reasons, this website uses SSL/TLS encryption. TLS encryption protects transmitted data against unauthorized interception while it is being transferred.

4. Data collection on this website

Cookies

Our website uses only technically necessary cookies or comparable technical storage technologies within the meaning of Section 25(2) No. 2 TDDDG. These serve purely functional purposes, such as system security, and do not require the user’s consent. No cookies are used for analytics, tracking, or marketing purposes. You can generally block the storage of cookies in your web browser.

Contact Form and Inquiries by Email, Telephone, or Fax

If you contact us via the contact form, email, telephone, or fax, the information you provide, including any personal data resulting from your inquiry, will be stored and processed by us for the purpose of handling your request.

This data is processed on the basis of Art. 6(1)(b) GDPR if your inquiry relates to the performance of a contract or is necessary in order to take steps prior to entering into a contract. In all other cases, processing is based on our legitimate interest in effectively handling inquiries addressed to us (Art. 6(1)(f) GDPR).

The data you submit to us will remain with us until the purpose for storing the data no longer applies, for example once your inquiry has been fully processed, or until you request its deletion. Mandatory statutory provisions, in particular retention periods under tax and commercial law, remain unaffected.

Cloudflare Turnstile (Spam Protection)

We use the spam protection service “Cloudflare Turnstile” provided by Cloudflare Inc. (101 Townsend St, San Francisco, CA 94107, USA) on our website. The service is used to protect our contact form against automated access, spam, and bots.

The processing of data is based on our legitimate interest pursuant to Art. 6(1)(f) GDPR in protecting our IT systems and preventing misuse. Turnstile performs an invisible security check in the browser and evaluates only technical data, such as the IP address, browser characteristics, and device signals. In the configuration we use, no cookies are stored on the user’s device (Section 25(2) No. 2 TDDDG). As Cloudflare is headquartered in the United States, data transfers are safeguarded by the provider’s active certification under the EU-U.S. Data Privacy Framework (DPF).

Cloudflare Turnstile processes, among other things, the IP address, TLS fingerprint, user agent, sitekey, and originating website. Turnstile statistics may also include information such as browser, operating system, IP address, ASN, and country. Cloudflare also processes certain signals under its own responsibility in order to improve bot detection.

For more information regarding privacy practices, please refer to the Cloudflare Turnstile Privacy Policy at https://www.cloudflare.com/turnstile-privacy-policy/.

5. Plugins, Tools and Social Media Links

Font Awesome (Local Integration)

This website uses Font Awesome for the consistent display of fonts and icons. The fonts are installed locally on our server. When the website is loaded, no connection is established to third-party servers and no data is transmitted to the provider of Font Awesome.

Links to Social Media (Facebook, Instagram, YouTube)

Our website contains only links to our profiles on Facebook, Instagram, and YouTube. Simply visiting our website does not result in any data being transmitted to the respective platform operators through these links. Only when you click on a link will the respective external platform be accessed. The respective platform operator is generally responsible for the data processing carried out there.

If you communicate with us via our social media profiles, we process the data you provide in order to handle your inquiry on the basis of Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR, as applicable.

For certain statistical analyses (“Insights”) relating to our Facebook and Instagram profiles, we are jointly responsible with Meta Platforms Ireland Limited pursuant to Art. 26 GDPR. Meta provides an agreement on joint controllership („Page Insights Controller Addendum“ / https://www.facebook.com/legal/terms/page_controller_addendum), which sets out, in particular, the respective allocation of responsibilities. For any further processing carried out by Meta, as well as for processing on YouTube by Google, the privacy policies of the respective platform operators apply.

6. Contract and Transport Processing

For the preparation of quotations and the performance of transport orders, we process the customer, contact, collection, delivery, and order data required for these purposes. Photos of the transported goods may also be taken to document their condition, packaging, collection, and delivery.

Processing is based on Art. 6(1)(b) GDPR and, in the case of data relating to contact persons, senders, or recipients, on Art. 6(1)(f) GDPR. Processing required by law, in particular for customs clearance, is carried out on the basis of Art. 6(1)(c) GDPR.

Where necessary for order processing, we may disclose data to transport and logistics service providers, customs agents and authorities, insurers, senders, recipients, and other parties involved in the transport.

The data is stored after completion of the order in accordance with statutory retention and limitation periods and is then deleted.

7. Processing of Applicant Data

If you apply for a position with us, we process your application and contact data exclusively for the purpose of carrying out the application process. The legal basis is Art. 6(1)(b) GDPR in conjunction with Section 26(1) BDSG.

If no employment relationship is established, we generally delete your application data no later than six months after completion of the application process. Temporary continued storage serves the purpose of establishing, exercising, or defending possible legal claims and is based on Art. 6(1)(f) GDPR.

Any longer storage, for example for inclusion in an applicant pool, will only take place with your explicit consent pursuant to Art. 6(1)(a) GDPR. You may withdraw this consent at any time with effect for the future.

–––