We operate our website in accordance with the following principles:
We undertake to comply with the legal provisions of data protection and we endeavour to always consider the principles of data avoidance and data minimisation.
1. Name and address of the controller of the website
The controller for the purposes of the General Data Protection Regulation and other national data protection laws of the member states of the European Union, as well as other data privacy regulations, is:
European Waterpark Association e.V.
Dr Klaus Batz
Tel.: +49 (0) 911 / 24 06 145
Fax: +49 (0) 911 / 24 06 146
2. Definition of terms
3. Legal basis for processing personal data
We process your personal data, e.g. your surname and first name, your email address and IP address, etc. only if there is a legal basis for it. According to the General Data Protection Regulation, three specific rules are considered:
- You have given us your consent to process your personal data for one or more purpose(s), Art. 6 Para. 1 Clause 1 lit. a of the GDPR. In this case, you will be informed in detail about the purpose or purposes of the processing, and your express consent will be documented by us.
- The processing of your personal data is necessary to fulfil a contract, or to carry out pre-contractual measures with you, 6 Para. 1 Clause 1 lit. b of the GDPR.
- The processing of personal data is necessary for safeguarding our legitimate interests, unless your interests or fundamental rights and freedoms predominate, 6 Para. 1 Clause 1 lit. f of the GDPR.
However, we will always inform you about the legal basis for the processing of your personal data in each respective case.
4. Passing on personal data
Your personal data will not be transmitted to third parties for purposes other than those listed below. We only share your personal information with third parties in the following cases:
- You have given your express consent in accordance with Art. 6 Para. 1 Clause 1 lit. a of the GDPR
- The disclosure in accordance with Art. 6 Para. 1 Clause 1 lit. f of the GDPR is necessary for the assertion, exercise or defence of legal claims, and there is no reason to believe that you have an overriding interest in the non-disclosure of your data
- There is a legal obligation for the disclosure in accordance with Art. 6 Para. 1 Clause 1 lit. c of the GDPR
- It is legally permitted and required in accordance with Art. 6 Para. 1 Clause 1 lit. b of the GDPR for the settlement of contractual relationships with you
5. Storage duration and deletion
We store all personal data transmitted to us for as long as it is needed to fulfil the purpose(s) for which the data was transmitted, or for as long as it is required by law. With the fulfilment of purpose and/or expiry of the statutory retention periods, the data will be deleted or blocked by us.
6. SSL Encryption
This website uses SSL encryption for security reasons and for protecting the transfer of confidential content, such as the queries you send us as the website operator. You can recognise an encrypted connection by the fact that the browser’s address bar changes from “http://” to “https://” and by the lock icon in your browser line.
When SSL encryption is activated, the data you transmit to us cannot be read by third parties.
7. Collection and storage of personal data, as well as the nature and purpose of the use
a) When visiting the website
When you visit our website, the browser that is used on your device automatically sends information to the server on our website. This information is stored temporarily in a so-called log file. The following information is recorded without any action on your part and is stored until automated deletion:
- IP address of the requesting computer
- Date and time of access
- Name and URL of retrieved file
- The website from which access occurs (Referrer URL)
- Browser used and, if applicable, the OS of your computer, as well as the name of your access provider
The mentioned data will be processed by us for the following purposes:
- To ensure a smooth connection to the website
- To ensure a comfortable use of our website
- To evaluate system security and stability
- For further administrative purposes
Data that could identify your person, such as the IP address, will be deleted after 7 days at the latest. If we save the data beyond this period, this data is pseudonymised, so that a connection to your person is no longer possible.
The legal basis for the data processing is Art. 6 Para. 1 Clause 1 lit. f of the GDPR. Our legitimate interest results from the data collection purposes listed above. We will never use the collected data for the purpose of identifying your person.
b) Members’ Area
We offer our members the possibility to register on our website and use the multiple functions of the members’ area.
The legal basis for processing your personal data results from the consent given by you in accordance with Art. 6 Para. 1 Clause 1 lit. a of the GDPR. You can revoke your consent at any time. To do this, you can simply send an email to firstname.lastname@example.org. We inform you that a revocation of consent does not affect the legality of the processing granted by the consent until the point of revocation.
In the following, we explain in detail what types of data we process and for what purpose we process them.
Members have the possibility to register on our website. A distinction must be made here between registration data (mandatory data) and voluntary data.
Registration data consists of:
- Name, surname
- Email address
- Company name
- Company address
- Telephone number
- Billing address
Voluntary data consists of:
- Mobile number
- Date of Birth
bb) Function of the members’ area:
- Member Directory:
When you register, you will be included in the Member Directory using the data you have provided. The Member Directory is visible to all members. This way, members have the possibility to contact other members directly.
EWA events are published in the members’ area. Members can register to participate. When a member registers for an event, the name of the event, the corresponding programme, and the number of days for which the member has registered will be saved.Other members can see in a list of participants which other members have registered for an event.Additionally, in the case of booking accommodation, entered data will be passed on to the respective hotel for the purpose of making a reservation. The transfer of the data to your chosen hotel is carried out based on Art. 6 Para. 1 Clause 1 lit. b) of the GDPR for fulfilling a contractual obligation.
In the chat area, you have the possibility to chat with other members. The chat history is saved. You can also choose to deactivate the chat feature.
You have the possibility to participate in the discussion forum. After the EWA has approved your submitted posts, they will be published in the members’ area and can be read by other members. Your first name, surname, and the name of your company will be published along with the post.
Press releases and newsletters are published in this area.
A calendar with an overview of EWA events, which can be exported to Outlook.
We will only send you a newsletter if you have ordered it from us and have given your consent in accordance with Art. 6 Para. 1 Clause 1 lit. a of the GDPR. The contents of the newsletter are described in detail when registering for the newsletter. To register for the newsletter, it is sufficient to enter your email address. If you have any other pieces of voluntary information such as your name and/or gender, they will be used exclusively for personalising the newsletter addressed to you.Double-Opt-In and Logging
When registering for our newsletter, we use the so-called double-opt-in procedure for security reasons, so that no one can register with unfamiliar email addresses. After you have registered for our newsletter, you will receive an email requesting to confirm your registration. This will come into effect once we receive the registration confirmation.Your registration for the newsletter is also logged. Logging includes the storage of the registration and confirmation date, your specified data, and your IP address. When you make changes to your data, those changes are also logged.Revocation
If you no longer wish to receive our newsletter, you can revoke your consent at any time with future effect. To cancel the newsletter, you can click on the link at the end of any issue of the newsletter, or send us an email to the following address: email@example.comThe revocation of consent does not affect the legality of the processing granted by the consent until the point of revocation.
c) Contact form / Email Contact
On our website, we provide you with a form so that you have the possibility to contact us at any time. To use the contact form, it is essential to provide a name for a personal address and a valid email address for making contact, so that we know who sent the request and we can also process it.
If you send us queries via the contact form, your details will be displayed in the request form, including the contact details you provided there, as well as your IP address, in accordance with Art. 6 Para. 1 Clause 1 lit. b and f of the GDPR to implement pre-contractual measures, which are carried out at your request, or to exercise our legitimate interest, namely to carry out our business activities.
Alternatively, you are welcome to send us an email using the email address provided on our website. In this case, we store and process your email address, as well as the information you provide in the email, in accordance with Art. 6 Para. 1 Clause 1 lit. b and f of the GDPR to process your message.
The queries, as well as the accompanying data, will be deleted no later than 3 months after receipt if they are not needed for a further contractual relationship.
d) Use of Google Maps
Our website uses the Google Maps API. Through using Google Maps, information about your use of this website (including your IP address) can be sent to a Google server (Google Inc., 1600 Amphitheatre Parkway, Mountain View, California, 94043) in the USA and stored there.
Google may transfer the information obtained through maps to third parties if it is required by law or if third parties process this data on behalf of Google. However, your IP address will not be associated with any other data from Google. Nevertheless, we must point out that it would be technically possible for Google to identify individual users based on the data received.
Google Maps is a service we use to enable you to identify our location and, if applicable, to help you plan your visit with us more efficiently. The use of Google Maps is therefore based on our legitimate interests in accordance with Art. 6 Para. 1 Clause 1 lit. f of the GDPR.
The data processed by cookies is necessary for the mentioned purposes to protect our legitimate interests, as well as the third party in accordance with Art. 6 Para. 1 Clause 1 lit. f of the GDPR.
Most browsers automatically accept cookies based on the browser preferences. However, you can configure your browser to either not store cookies on your device at all, or at least display a notice before a new cookie is saved. If you completely disable the cookie function in your browser, you may not be able to use all the features of our website.
The following is a description of the different types of cookies we use.
- Session Cookies
To make the use of our website as pleasant possible, we use so-called session cookies to recognise which pages you have already visited on our website.
These session cookies will be deleted automatically after you leave our site.
- Temporary Cookies
These temporary cookies are stored on your device for a specified period.
- Cookies for marketing and optimisation purposes
These cookies are automatically deleted after a defined period.
9. Rights of the person concerned
You have the following rights:
You have in accordance with Art. 15 of the GDPR the right to request information about your personal data processed by us. This right of information includes information on the following:
- Processing purpose(s)
- Categories of personal data
- Recipients or categories of recipients to whom your data has been or will be disclosed
- Scheduled storage duration or at least the criteria for determining the storage duration
- The existence of a right to rectification, deletion, restriction of processing or revocation
- The existence of a right of appeal to a supervisory authority
- The origin of your personal data, if it is not collected by us
- The existence of automated decision-making including profiling and, where applicable, significant information on their details
You are entitled in accordance with Art. 16 of the GDPR to an immediate correction of any incorrect or incomplete personal data stored by us.
In accordance with Art. 17 of the GDPR, you have the right to request the immediate deletion of your personal data stored by us, unless any further processing of the data is necessary for one of the following reasons:
- For exercising the right to freedom of expression and information
- For fulfilling a legal obligation that requires processing in accordance with the law of the European Union or the member states, to which the controller is subject, or to fulfil a task that is in the public interest or as an execution of public authority, which has been transferred to the controller
- For reasons of public interest in the realm of public health in accordance with Art. 9 Para. 2 lit. h and i, as well as Art. 9 Para. 3 of the GDPR
- For archival purposes in the public interest, scientific or historical research purposes or for statistical purposes in accordance with Art. 89 Para. 1 of the GDPR, to the extent that the law referred to in section a) is likely to render impossible or seriously impair the accomplishment of the objectives of this processing
- For the assertion, exercise or defence of legal claims
d) Restriction of processing
In accordance with Art. 18 of the GDPR, you may request the restriction of the processing of your personal data for one of the following reasons:
- You contest the accuracy of your personal data
- The processing is unlawful, and you object to the deletion of the personal data
- We no longer need the personal data for the purposes of processing, but you need it for the assertion, exercise or defence of legal claims
- You object to the processing in accordance with Art. 21 Para. 1 of the GDPR
e) Notification obligation regarding rectification or deletion of personal data or restriction of processing
If you have requested the correction or deletion of your personal data or a restriction of the processing in accordance with Art. 16, Art. 17 Para. 1 and Art. 18 of the GDPR, we share this with all recipients to whom your personal data has been disclosed, unless this proves impossible or involves a disproportionate effort. You may request that we notify you of these recipients.
You have the right to receive your personal data, which you have provided, in a structured, standard and machine-readable format.
You also have the right to request the transmission of this data to a third party, provided the processing is carried out using automated procedures and based on consent in accordance with Art. 6 Para. 1 Clause 1 lit. a or Art. 9 Para. 2 lit. a, or based on a contract in accordance with Art. 6 Para. 1 Clause 1 lit. b of the GDPR.
In accordance with Art. 7 Para. 3 of the GDPR, you have the right to revoke your consent at any time to us. Revocation of consent does not affect the legality of the processing granted by the consent until the point of revocation. In future, we will no longer process your data based on your revoked consent.
In accordance with Art. 77 of the GDPR, you have the right to complain to a supervisory authority if you believe that processing your personal data violates the rules of the GDPR.
If your personal data is processed based on legitimate interests in accordance with Art. 6 Para. 1 Clause 1 lit. f of the GDPR, you have the right in accordance with Art. 21 of the GDPR to object to your personal data being processed, if reasons arise from your specific situation, or if an objection to direct advertising is addressed. In the latter case, you have a general right of objection, which is executed by us without stating the specific situation. If you wish to utilise your right of revocation or objection, it is sufficient to send us an email to firstname.lastname@example.org
j) Automated decision-making in individual cases, including profiling
You have the right not to be subjected to a decision that is based solely on automated processing, including profiling, which could have a legal effect on you or may have a similar impact on you. This does not apply if the decision
- is required for the conclusion or fulfilment of a contract between you and our association,
- is permitted based on the legislation of the European Union or of the member states, to which we are subject, and this legislation contains appropriate measures to safeguard your rights and freedoms and legitimate interests,
- is made with your express consent.
However, these decisions may not be based on specific categories of personal data in accordance with Art. 9 Para. 1 of the GDPR, unless Art. 9 Para. 2 lit. a or g of the GDPR applies and appropriate measures have been taken to protect the rights and freedoms, as well as your legitimate interests.
Regarding the points in i) and (iii), we shall take appropriate measures to safeguard the rights and freedoms and your legitimate interests, which includes at least the right to the intervention of a person on our part, the presentation of his/her own position and the challenge of the decision.
As of 16th May 2018