Data Processing Information

Data Protection Officer: Mr Gunar Laaser
Email: datenschutzbeauftragter@a-rosa.com

As a tour operator, A-ROSA Flussschiff GmbH and A-ROSA Reederei GmbH collect, process and use their personal data in prospect and customer administration and customer support only in accordance with the statutory provisions. The data is only collected and processed in the context of the fulfilment of travel bookings/travel contracts with the associated services. This includes, among other things, information for the ship manifest, opinion surveys and the assessment of travel services. The A-ROSA Reederei GmbH is responsible for the operational process of your trip. It processes the collected data for the purpose of the contractual provision of services.

The collection, processing and use of data is carried out within the framework of the conduct of business for the purposes stated above. If required by law, your data will be stored as evidence in accordance with the requirements for the tax authorities.

The following overview shows the data processing responsibilities:

The data processing is based on your request / interest and is necessary according to Art. 6 (2) DS-GVO (the processing is necessary for the performance of a contract to which the data subject is party or for the implementation of pre-contractual measures taken at the request of the data subject) for the aforementioned purposes for the adequate processing of the travel booking.

If we have consent for the processing of your personal data, the legal basis for this is Art. 6 (1) lit. a of the EU General Data Protection Regulation (DSGVO).

When processing personal data that is required to fulfil a contract with you, Art. 6 para. 1 lit. b DSGVO serves as the legal basis. This also applies to processing operations that are necessary for the implementation of pre-contractual measures.

Your personal data may be passed on to our service providers as part of the travel processing. We only pass on the data to third parties that are necessary for the provision of the travel service and its billing (e.g. contract data to the airline, data from the ship manifest to the port authorities). In addition to their legal obligation to comply with all data protection regulations, these service providers are also bound by other data protection-related specifications instructed by us.

When booking a trip, we also collect personal data from fellow passengers. We would therefore ask you to ensure that this data is provided to us with the consent of the fellow travellers. Personal data of children and adolescents (under 18 years of age) will only be collected, stored and used for the purpose of travel arrangements.

Personal data will only be collected and transmitted to state institutions and authorities within the framework of mandatory legal provisions.

Insofar as it is necessary for the purpose of travel processing, we may also transfer your data to recipients outside the EU if it is ensured that the recipient of the data guarantees an adequate level of data protection and no other interests worthy of protection speak against the transfer of data. To ensure an adequate level of protection for the recipient of the data, we use in particular the EU Commission's model contracts for the transfer of personal data to third countries.

Where the data has not been collected directly from the data subject, we receive personal data for the fulfilment of a contract from travel agencies, travel agents or tour operators.

We require the following data for the fulfilment of the contract / for the execution of the trip:

Contract data: Name, first name, title, street, house number, postcode, city, country, credit card details (PCI Standard), telephone number, e-mail address, if applicable.

The deletion of data relevant to the contract is carried out in accordance with legal requirements and takes place after 10 years (tax law).

Manifest data: Gender, passport/ID card number, nationality, date of birth, emergency telephone number, voluntary additional information.

Ship manifest data is deleted 2 years after the end of the trip (EU Package Travel Directive).

Trustpilot: The contact data transmitted for the purpose of issuing invitations to review our products, services and booking process will be erased by the respective service provider within 7 days.