Privacy Policy

Data Subjects

This declaration applies to all persons who are customers of the data controller, including potential and former customers. All personal designations refer to all genders and related linguistic forms, in particular female, male, diverse. Each personal designation is to be understood with the addition „(m/f/d)“.

Data Controller

The data controller for the processing described herein is: Anita Fischer, Impasse do Espigão 6, 9370-249 Estreito da Calheta, Telephone: +351 964 122 911. E-mail: anita@madeira.cc

This privacy policy was created by the privacy policy generator of DGD Deutsche Gesellschaft für Datenschutz GmbH, which operates as an External Data Protection Officer Munich, in cooperation with Data Protection Lawyer Christian Solmecke.  

Rights of Data Subjects and Other Information

(1) Data subjects have the following rights with regard to their personal data stored: the right to information, the right to rectification of incorrect data, the right to erasure of data for which there is no longer a retention reason, the right to restriction of processing, and the right to data portability. Furthermore, they have the right to lodge a complaint with the supervisory authority responsible for the data controller. (2) If the processing is based on the consent of the data subject, the data subject may withdraw their consent at any time with effect for the future; for example, by sending an informal message to one of the above-mentioned contact channels (data controller). (3) If the processing is based on the fulfillment of a legitimate interest, i.e., on Article 6(1)(f) GDPR, data subjects may object to the processing at any time; for example, by sending an informal message to one of the above-mentioned contact channels (data controller). If the objection is justified, the processing will be terminated. If the legitimate interest lies in direct marketing, the objection is always justified. (4) Automated decision-making, including profiling, does not take place. (5) A legal obligation to process exists only if reference is made to Article 6(1)(c) GDPR below. (6) If data processing is described below, this does not mean that data subjects have any kind of claim to the associated actions (e.g., media recordings, evaluations). The data subject’s claims arise from paragraphs 1 to 3 of this section. The data processing described below only describes possible courses of action, which do not apply to all data subjects.  

Transfer to Countries Outside the European Union

(1) If personal data is transferred to entities outside the European Union, the data controller must provide supplementary safeguards in accordance with Articles 44 et seq. GDPR. (2) If the data controller refers to a so-called adequacy decision in the following privacy policy, this means that the receiving entity is located in a country, territory, or specific sector to which the EU Commission has decided that it provides an adequate level of data protection. The guarantee then follows from Article 45 GDPR. (3) If the data controller refers to the so-called EU standard contractual clauses in the following privacy policy, this means that the receiving entity has contractually committed to respecting the EU data protection principles, based on the so-called EU standard contractual clauses. The guarantee then follows from Article 46 GDPR. (4) If the data controller refers to so-called binding internal data protection rules in the following privacy policy, this means that the competent supervisory authority has approved the transfer. The guarantee then follows from Article 47 GDPR. (5) If the data controller refers in the following privacy policy to the fact that the data subjects have expressly consented to the transfer to a country outside the European Union, this means that they agree to the transfer in knowledge of all associated risks. The guarantee then follows from Article 49(1)(a) GDPR. Any risk notices are located in the glossary.  

Extraordinary Data Processing

Promotional Communication via Email (Legitimate Interest)

The data controller uses the email addresses of data subjects to contact them for promotional purposes. In doing so, it processes the following data: name, email address. The legal basis is Article 6(1)(f) GDPR, with the legitimate interest arising from the contractual status and Recital 47 GDPR.

Promotional Communication via Email (Consent)

(1) The data controller uses the email addresses of data subjects to contact them for promotional purposes. (2) If data subjects choose to do so, the data controller obtains the necessary consent. For this purpose, it processes the name, time, and status of the consent. The purpose is to fulfill a legal obligation. The legal basis is Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR. (3) The data controller uses the email addresses to contact the data subjects for promotional purposes. In doing so, it processes the following data: name, email address. The legal basis is the consent of the data subjects within the meaning of Article 6(1)(a) GDPR.

Special Situation: Events

The data controller conducts events and processes the data of data subjects during registration for and execution of the event. In doing so, it generally processes the following data: name, contact details, participation status. The purpose is to conduct the event. The legal basis is Article 6(1)(b) GDPR. The following should be added regarding the event:

Registration via Invitation of Existing Contacts

The data controller uses the contact details of data subjects that it already stores and that it may use for these purposes in accordance with Article 5(1)(a) GDPR, and proactively invites these data subjects to the event. The following data is processed: name, contact details. The processing serves the invitation to the event. The legal basis is Article 6(1)(b) GDPR.

Registration via Open Registration Option

The data controller allows open registration for the event and documents the registrations. The following data is processed: name, contact details, registration status. The processing serves the registration for the event. The legal basis is Article 6(1)(b) GDPR.

Paid Event

If the event is subject to a fee, invoices are created, sent, and the payment status is checked. The following data is processed: name, billing address, payment status. The purpose is to enforce the data controller’s own remuneration claim, insofar as it serves the execution of the event contract. The legal basis is Article 6(1)(b) GDPR.

Free Event

If the event is free of charge, invitations are created and sent. The following data is processed: name, contact details, payment status. The purpose is to conduct the event. The legal basis is Article 6(1)(b) GDPR.

In-Person Event Format

If the event is an in-person event, access to the event is documented at the entrance. The following data is processed: name, contact details, access status. The processing serves the conduct of the event. The legal basis is Article 6(1)(b) GDPR.

Online Event Format

If the event is an online event, access to the event is documented at the entrance, and audio, image, and video data may be processed; however, only if data subjects participate voluntarily and activate their camera or microphone. The following data is processed: (1) name, contact details, access status, (2) audio, image, and video data. The processing serves the conduct of the event. For the data in category (1), Article 6(1)(b) GDPR is the legal basis. For the data in category (2), Article 6(1)(a) GDPR is the legal basis. This does not conflict with the prohibition under Article 9(1) GDPR, as the exception under Article 9(2)(a) GDPR applies.

Hybrid Event Format

(1) The following applies to hybrid events: (2) If the event is an in-person event, access to the event is documented at the entrance. The following data is processed: name, contact details, access status. The processing serves the conduct of the event. The legal basis is Article 6(1)(b) GDPR. (3) If the event is an online event, access to the event is documented at the entrance, and audio, image, and video data may be processed; however, only if data subjects participate voluntarily and activate their camera or microphone. The following data is processed: (1) name, contact details, access status, (2) audio, image, and video data. The processing serves the conduct of the event. For the data in category (1), Article 6(1)(b) GDPR is the legal basis. For the data in category (2), Article 6(1)(a) GDPR is the legal basis. This does not conflict with the prohibition under Article 9(1) GDPR, as the exception under Article 9(2)(a) GDPR applies.

Acquisition During and/or After the Event

The data controller uses the email and postal addresses of data subjects who participate in the event to contact them for promotional purposes. The following data is processed: name, email address, address, contractual status. The processing serves the promotional communication and direct marketing. The legal basis is Article 6(1)(f) GDPR, with the legitimate interest arising from the contractual status and Recital 47 GDPR.

Media Recordings During the Event

(1) The data controller documents the event with media recordings (photo, audio, film).