Data protection information pursuant to Art. 13 and 14 GDPR

for website users

1         Scope

This data protection declaration applies to the website of Setur GmbH and to the personal data processed on this website. For websites of other providers, which are referred to e.g. via links or which are integrated via iFrames, the data protection notices of those providers apply.

2         Responsible

Setur Ltd.

Rudolfplatz 3

50674 Cologne

3         Subject of the data processing

3.1       Personal data

According to Art. 4 GDPR, personal data means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by association with an identifier such as a name, an identification number, location data, an online identifier or with one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

3.2       Hosting

As part of the hosting of our website, all data processed in connection with the operation and use of the website is stored. This is necessary to enable the operation of the website. The processing of personal data is accordingly based on our legitimate interest according to Art. 6 (1) (b) GDPR. To provide our online presence, we use the services of web hosting providers to whom we transmit the above-mentioned data.

3.3       Log files

We log your visit to our website. The following personal data is processed in the process:

Name of the website accessed, date and time of access, access status, the amount of data transferred, the browser type and version, the operating system you are using, the referrer URL (the website previously visited), your IP address and the requesting provider.

This processing is necessary to ensure the security of our website. The processing of personal data is therefore based on a legitimate interest pursuant to Art. 6 (1) (f) GDPR.

3.4       Contact form

If you contact us via our contact form, we will process your personal data (name, contact details, flight number, if applicable, if you have provided one) and your message exclusively for the purpose of processing and handling your enquiry.

This data is processed by us on the basis of Art. 6 (1) (b)  GDPR or Art. 6 (1) (f) GDPR for the purpose of processing your enquiry.

3.5       Click&Collect

When you order items in our Click & Collect Platform, we process personal data as part of the reservation. This processing is necessary in order to process your reservation and provide you with the reserved items in the selected Setur Shop.

The following categories of personal data may be processed in this context:

Financial data (such as bank account and credit card details), Flight ticket information, ID information (such as name, number of the ID document), Data on your purchase

The processing of this personal data is based on Art. 6 (1) (b) GDPR.

3.5       Customer Accounts

You shall open a customer account on our website to want to make pre-order.In this customer account, personal data about you will be stored (including name, address, order information).

To log in to the customer account, it is necessary for you to enter the e-mail address used during registration and the password assigned by you. Our password policy requires that you use a secure password.

In order to provide you with the greatest possible convenience, we offer you the permanent storage of your personal data in a password-protected customer account.

The creation of the customer account is voluntary.

If you create a customer account, the processing of your data collected for the maintenance of the customer account is based on Art. 6 (1) (b) GDPR. After setting up a customer account, no new data entry is required. In addition, you can view and change the data stored about you in your customer account at any time.

You have the option to delete your customer account at any time.

The legal basis for this further data processing is Art. 6 (1) (c) GDPR and Art. 6 (1) (b) GDPR.

3.7       Website analysis and marketing

We use cookies to enable the use of certain functions. These are short data packets that are stored on your terminal device and exchanged with other providers. Some of the cookies we use are deleted immediately after you close your browser (so-called session cookies). Other cookies remain on your end device and make it possible to recognise your browser the next time you visit (persistent cookies).

You can delete all cookies stored on your terminal device and set the common browsers to prevent cookies from being stored. In this case, you may have to make some settings again each time you visit this website and accept the impairent of some functions.

In connection with which functionalities we use cookies, you can see the overview at the end of this privacy policy.

The legal basis for the processing of personal data in the context of the below mentioned analysis and marketing measures is your consent pursuant to Art. 6 (1) (a) GDPR in conjunction with Section 25 (2) of the German Telecommunication Telemedia Data Protection Act (“TTDSG”). In addition to being able to refuse or withdraw your consent to the use of analytics and/or marketing cookies, you can prevent tracking by changing your browser software settings (e.g. disabling third-party cookies), disabling conversion tracking cookies by selecting cookies from the domain https://www.google.com/settings/ads/ in your browser settings, in relation to interest-based ads from providers that are part of the About Ads self-regulatory campaign, by clicking on the link http://www.aboutads.info/choices or on the link www.googleadservices.com. Please note that in this case you may not be able to use the full functionality of the website.

3.7.1       Google Analytics

We use Google Analytics, a web analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Google Analytics uses cookies to enable an analysis of website usage. The information generated by the cookie about your use of the website will be transmitted to and stored by Google on servers in the United States. is activated on our website so that the IP addresses of users are shortened beforehand by Google within member states of the European Union or in other contracting states to the Agreement on the European Economic Area. Only in exceptional cases will entire IP addresses be transferred to a Google server in the USA and shortened there. Google will use this information on our behalf for the purpose of evaluating your use of the website, compiling reports on website activity and providing other services relating to website activity and internet usage to the website operator.

During your visit to the website, the following data is recorded:

Pages viewed, reservations incl. prices and reserved products, contact requests, your behaviour on the pages (e.g. duration of visit, clicks, scrolling behaviour), your approximate location (country and city), your IP address (in shortened form so that no clear assignment is possible), technical information such as browser, Internet provider, terminal device and screen resolution, source of origin of your visit (i.e. via which website or advertising medium you came to us).

The provision of data is voluntary. You can prevent the collection of data generated by a cookie and related to website use (including your IP address) by Google and the processing of this data by Google by not giving your consent or by downloading and installing the Google browser plugin available under the following link. This will set an opt-out cookie that will prevent the future collection of data relating to your visit to this website. You can find more information on this here or here (general information on Google Analytics and data protection).

 

3.7.2       Google AdSense

Our website uses Google AdSense, an online advertising service provided by Google Inc (“Google“). Google AdSense uses “cookies“, which are text files placed on your computer, to help the website analyse how users use the site. Google AdSense also uses so-called web beacons (invisible graphics). These web beacons can be used to analyse information such as visitor traffic on the pages of this website. The information generated by cookies and web beacons about the use of this website (including the user's IP address) and the delivery of advertising formats is transmitted to a Google server in the USA and stored there. This information may be passed on by Google to Google's contractual partners. However, Google will not merge your IP address with other data stored by you.

The setting of the AdSense cookie can be prevented by setting the browser to refuse all cookies. However, this may affect your ability to use this website. You can also deactivate personalised advertising on the following page: https://adssettings.google.com/anonymous.

Further information on data protection by Google can be found at: https://www.google.com/intl/de/analytics/privacyoverview.html.

3.7.3       Google AdManager

We use Google AdManager, a service of Google Inc, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.  Google Ad Manager / Google Ad Exchange / Google Advertising Products (Google Ads) are services provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, whose components are used to optimise and display advertising on our website using cookies. These cookies are used to provide ads that are relevant to users, to improve campaign performance reports, or to prevent a user from seeing the same ads more than once.

Google Ads uses a cookie ID that is required to complete the technical process. It is used to record which ads are delivered in which browser. When an ad is to be served in a browser, Google Ads uses the cookie ID of the browser to check which Google Ads ads have already been served in that browser. This prevents ads from being delivered that the user has already seen. Cookie IDs can also be used to record conversions in Google Ads that are related to ad requests. This is the case, for example, when a user sees a Google Ads ad and later calls up the advertiser's website in the same browser and makes a purchase there. Google Ads cookies do not contain any personal data. However, a Google Ads cookie may contain additional campaign identifiers. A campaign identifier serves to identify the campaigns with which you have already been in contact.

The data collected in the context of the use of Google Ads is also used to create pro-vision statements. Google can, among other things, track that certain links on our website have been clicked on

Further information and the applicable data protection provisions of Google Ads can be found at https://www.google.com/intl/de/policies/.

3.7.4       Andere Dienste der Google Marketing-Platform (CampaignManager, Display & Video 360, Search 360)

Our website also uses other Google Marketing Platform (formerly known as “Google Doubleclick“) services. These services use cookies to serve ads that are relevant to users, to improve campaign performance reports or to prevent a user from receiving ads more than once. Campaign Manager 360 allows us to run ad campaigns and measure their performance. Display & Video 360 helps us manage display and video campaigns. Search Ads 360 is used to manage search campaigns in various search engines.

Google uses a cookie ID to determine which ads are served in which browser and can prevent them from being shown more than once. Google may also use cookie IDs to track conversions, i.e. whether a user sees an ad and later visits the advertiser's website to make a purchase. These cookies do not contain any personal information.

Your browser automatically establishes a direct connection with the Google server. According to Google, the integration of these services provides Google with the information that you have called up the relevant part of our website or clicked on one of our advertisements. If you are registered with a Google service, Google can assign the visit to your user account. Even if you are not registered with Google or have not logged in, it is possible for the provider to obtain and store your IP address.

In addition, we can use cookies to track whether you carry out certain actions on our website after you have seen or clicked on one of our ads on Google or on another platform (conversion tracking) (“floodlight”). Google uses this cookie to understand the content you have interacted with on our websites so that we can later send you targeted advertising.

During your visit to the website, the following data is recorded:

the IP address, browser information, date and time of your request, one or more cookies, which may uniquely identify your browser, and the Google ClickID, to collect pseudonymous promotional data.

Further information about the Google Marketing Platform can be found at https://marketingplatform.google.com/. Further information can also be found at the Network Advertising Initiative (NAI) at http://www.networkadvertising.org/.

3.7.5       Youtube

We have integrated Youtube videos on our website. This way we can present you interesting videos directly on our site. Youtube is a video portal that has been a subsidiary of Google since 2006. The video portal is operated by Youtube, LLC, 901 Cherry Ave, San Bruno, CA 94066 USA. When you call up a page on our website that has a YouTube video embedded, your browser automatically connects to the servers of YouTube or Google. In the process, various data are transferred (depending on the settings). Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland) is responsible for all data processing in Europe.

As soon as you visit one of our pages that has a YouTube video embedded, YouTube sets a cookie that stores your IP address and our URL. If you are logged into your YouTube account, YouTube can assign your interactions on our website to your profile, usually with the help of cookies.

This includes data such as session duration, bounce rate, approximate location, technical information such as browser type, screen resolution or your internet service provider. Other data may include contact details, any ratings, sharing of content via social media or adding to your favourites on YouTube.

If you are not signed into a Google Account or YouTube account, Google stores data with a unique identifier associated with your device, browser or app. For example, your preferred language setting is retained.

The data that YouTube receives from you and processes is stored on Google servers. Most of these servers are located in America. Go to https://www.google.com/about/datacenters/locations/?hl=desehen to find out exactly where Google's data centres are located. Your data is distributed across the servers. This means that the data can be accessed more quickly and is better protected against manipulation.

Google stores the collected data for different lengths of time. Some data you can delete at any time, others are automatically deleted after a limited time and still others are stored by Google for a longer period of time. Some data (such as elements from “My Activity“, photos or documents, products) stored in your Google Account remain stored until you delete them. Even if you are not signed in to a Google Account, you can delete some data associated with your device, browser or app.

Basically, you can delete data in your Google Account manually. With the automatic deletion of location and activity data introduced in 2019, information will be stored for either 3 or 18 months depending on your decision and then deleted. Whether you have a Google Account or not, you can configure your browser to delete or disable cookies from Google. Depending on which browser you use, this works in different ways. Under the section “Cookies” you will find the corresponding links to the respective instructions for the most popular browsers. If you generally do not want cookies, you can set up your browser so that it always informs you when a cookie is to be set. In this way, you can decide for each individual cookie whether you allow it or not.

This website uses a link to YouTube of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When embedding, we use the “” so that usage information is only transmitted when the video is started. In this case, it is transmitted which specific page of our website you are visiting and which video is being viewed. If you are logged into your YouTube account, you enable YouTube to assign your page views directly to your personal profile. Further information on the collection and processing of your data by YouTube can be found in the corresponding data protection information at www.youtube.com.

If you would like to ensure that no of your data is stored by YouTube, please do not click on the embedded videos.

3.7.6       Google Flights

Google Flights is a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use conversion scripts to track the success/completion of an action (purchases, newsletter subscriptions, effectiveness of advertising campaigns).

We use Google Flights on our website to serve customers who have been referred to our website by Google Flights. Google Flights uses first- and third-party cookies and can thus associate a booking with a previous session on the Google Flights website.

Google may use the information it collects in conjunction with information Google collects about you to personalise advertising on its own network. For more information, please see Google's privacy policy.

Further information about Google’s Data Privacy Policy can be found on  https://www.google.com/privacy/

4         Recipient of the data

Within our company, only those persons and offices receive your data that require it for the purposes outlined above, and only to the extent necessary for this purpose.

We only pass on your data to external recipients if this is necessary to achieve the above-mentioned purposes. On the one hand, these are companies within our group of companies, in particular Setur Servis Turistik A.S., as certain functions, in particular personnel administration, have been centrally outsourced to them within our group of companies.

The recipients of your data mentioned above may be located in countries outside the European Union/European Economic Area whose laws may not ensure an adequate level of data protection comparable to that in the EU/EEA. These countries are as follows:

• Turkey
• USA

In these cases, however, we have implemented appropriate safeguards in accordance with the legal requirements to ensure that your data is also adequately protected by the recipients in the above-mentioned countries and that the level of data protection required by European laws is not undercut (e.g. by concluding EU standard contractual clauses). To find out more about the recipients of your data and the appropriate safeguards we provide for the protection of your data, including the possibility of obtaining a copy of these safeguards, please contact the contact listed in section 1.

5         Automated decision making

Automated decision-making processes (including profiling) are processes in which no substantive evaluation and decision based thereon has taken place by a natural person.

We do not use any procedures for automated decision-making. In the event that we should use such procedures in the future, we will inform you of this in accordance with the legal obligations.

6         Duration of storage

We only store your data for as long as is necessary for the respective purposes of the processing. We generally store your data processed for as long as this is necessary. If storage of the data is no longer necessary for the fulfilment of contractual or legal obligations your data will be deleted, unless deletion is contrary to legal storage obligations or longer storage is necessary in the specific case for the fulfilment of other legal obligations or to protect our legitimate interests (e.g. assertion, exercise or defence of legal claims). Insofar as statutory retention obligations must be observed, the storage period for certain data can be up to 10 years, irrespective of the processing purposes.

The legal basis for this further data processing is Art. 6 (1) (c) GDPR and Art. 6 (1) (b) GDPR.

7         Your rights

You have the following rights in connection with the processing of your data:

• request information about the personal data processed about you and a copy of this data (right to information pursuant to Art. 15 GDPR);
• to demand the correction of inaccurate data and, taking into account the purposes of the processing, the completion of incomplete data (right to rectification pursuant to Art. 16 GDPR);
• to request the deletion of your data if there are legitimate grounds for doing so (right to erasure pursuant to Art. 17 GDPR);
• to request the restriction of the processing of your data, provided that the legal requirements are met (right to restriction of processing pursuant to Art. 18 GDPR);
• if the legal requirements are met, to receive the data provided by you in a structured, common and machine-readable format and to transfer this data to another person responsible or, insofar as this is technically feasible, to have it transferred by us (right to data portability pursuant to Art. 20 GDPR); as well as
• not to be subject to a decision based solely on automated processing, unless the legal requirements for this are met (Art. 22 GDPR).

You also have the right to,

• object to the processing of your data which is carried out to protect the legitimate interests of us or third parties, for reasons arising from your particular situation, in accordance with the statutory provisions (right of objection pursuant to Art. 21 (1) GDPR). If personal data is processed by us for the purpose of direct marketing, you have the right to object to this processing at any time without the need for special reasons (right of objection pursuant to Art. 21 (2) of the GDPR).

Insofar as the processing of your data is based on consent, you also have the right,

• revoke your consent at any time without this affecting the lawfulness of the processing of your data carried out on the basis of the consent until revocation.
• You can exercise your aforementioned rights, as well as revoke any declaration of consent, by contacting the contact details listed in section 1.

In addition, without prejudice to any other rights, you have the right to lodge a complaint with a supervisory authority at any time. The supervisory authority responsible for us is

Landesbeauftragter für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestr. 2-4
40213 Düsseldorf
Phone: 0211/38424-0
Fax: 0211/38424-999
E-mail: poststelle@ldi.nrw.de

Please let us know if any of the information we hold about you changes so that we can correct and update the information on our systems.

8         Updating the data protection notice

This data protection notice is subject to regular amendment and supplementation.

9         Cookie Notice

Cookies are pieces of information that are transmitted from our web server or third-party web servers to users' web browsers, where they are stored for later retrieval. Cookies may be small files or other types of information storage.

You can change or revoke your consent at any time from the cookie statement on our website.

We use “session cookies”, which are only stored for the duration of the current visit to our online presence (e.g. to enable the storage of your login status or the shopping cart function and thus the use of our online offer at all). In a session cookie, a randomly generated unique identification number is stored, a so-called session ID. In addition, a cookie contains information about its origin and the storage period. These cookies cannot store any other data. Session cookies are deleted when you have finished using our online offer and log out or close the browser, for example.

If users do not want cookies to be stored on their computer, they are asked to deactivate the corresponding option in the system settings of their browser. Stored cookies can be deleted in the system settings of the browser. The exclusion of cookies can lead to functional restrictions of this online offer.

Users are informed about the use of cookies in the context of pseudonymous range measurement within the scope of this data protection declaration. As far as legally required, we ask for your consent beforehand.

You can also object to the use of cookies used for reach measurement and advertising purposes via the deactivation page of the network advertising initiative (http://optout.networkadvertising.org/) and additionally the US website (http://www.aboutads.info/choices) or the European website (http://www.youronlinechoices.com/uk/your-ad-choices/).