1. General Information and Data Controller
This Privacy Policy informs you regarding the collection, processing, and utilization of personal data when using our website www.campviatic.com and availing of our camping equipment rental and delivery services.
- Brand Name: campviatic (operated as a trading name and proprietary brand under www.campviatic.com)
- Data Controller: www.campviatic.com (represented by the registered business entity)
- Contact Email: camping@campviatic.com
- Registered Address: [Insert Street Address, Postal Code, City, Germany]
The data controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data (e.g., names, email addresses, etc.).
2. Legal Basis for Data Processing (GDPR Compliance)
In accordance with the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG), we process personal data only when a legal basis exists. This includes:
- Consent (Art. 6 Abs. 1 lit. a GDPR): Where the user has given consent to the processing of their personal data for specific purposes.
- Contract Fulfillment (Art. 6 Abs. 1 lit. b GDPR): Where processing is necessary for the performance of a rental agreement or to take steps prior to entering into a contract.
- Legal Obligation (Art. 6 Abs. 1 lit. c GDPR): Where processing is necessary for compliance with a legal obligation to which we are subject (e.g., commercial and tax retention requirements under German law).
- Legitimate Interests (Art. 6 Abs. 1 lit. f GDPR): Where processing is necessary for the purposes of our legitimate interests, provided such interests are not overridden by the fundamental rights and freedoms of the data subject.
3. Payment Processing via Stripe
To process payments securely for our rental and delivery services, we integrate payment processing services provided by Stripe.
- Payment Service Provider: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland.
- Data Collected during Payment: When you make a payment, personal data such as your name, billing address, payment card details, and transaction amount are transmitted directly to Stripe.
- Legal Basis: The processing of this data is necessary for the performance of the contract pursuant to Art. 6 Abs. 1 lit. b GDPR.
- Stripe Privacy Policy: For further details regarding Stripe’s data handling practices, security measures, and compliance frameworks, please refer to the official Stripe Privacy Policy available at https://stripe.com/privacy.
4. Data Retention Periods
We store personal data only for as long as necessary to fulfill the purposes for which it was collected, including compliance with legal, accounting, or reporting requirements.
- Contractual and Transaction Data: In accordance with commercial and tax retention periods mandated by German law (specifically under the German Commercial Code / Handelsgesetzbuch – HGB and the German Fiscal Code / Abgabenordnung – AO), accounting records, booking documents, and relevant transaction data associated with Stripe payments are stored for 10 years.
- Communication and Inquiry Data: General inquiries and correspondence submitted via email are retained for the duration required to address the inquiry and for a subsequent period in accordance with statutory limitation periods (typically 3 years under the German Civil Code – BGB, unless a longer statutory period applies).
- Deletion or Anonymization: Once the applicable retention periods expire, corresponding personal data is routinely deleted or anonymized, provided it is no longer required for the initiation or fulfillment of a contract.
5. Rights of the Data Subject
Under the GDPR, users enjoy extensive rights regarding their personal data. You have the right to:
- Access (Art. 15 GDPR): Request confirmation as to whether personal data concerning you is being processed and obtain access to such data.
- Rectification (Art. 16 GDPR): Demand the immediate correction of inaccurate personal data or completion of incomplete data stored by us.
- Erasure (Art. 17 GDPR): Request the deletion of your personal data, subject to statutory retention obligations.
- Restriction of Processing (Art. 18 GDPR): Request the restriction of data processing under specific statutory conditions.
- Data Portability (Art. 20 GDPR): Receive your personal data provided to us in a structured, commonly used, and machine-readable format.
- Withdrawal of Consent (Art. 7 Abs. 3 GDPR): Revoke any given consent at any time with effect for the future.
- Lodge a Complaint (Art. 77 GDPR): File a complaint with a competent supervisory authority regarding our data processing activities.
6. Data Security Measures
We implement robust technical and organizational security measures in compliance with European standards to protect personal data against accidental or intentional manipulation, partial or complete loss, destruction, or unauthorized access by third parties. Our security protocols are continuously reviewed and adapted in line with technological advancements.