Privacy Notice

We are pleased about your visit to our partner portal as well as your interest in our company and our products. We take the protection of your personal data very seriously and would like you to know how and for what purpose your data will be saved or used.

1. What this Privacy Notice covers
2. Personal data we collect
3. Using your personal data
4. Marketing communications
5. Provision of online services and web hosting
6. Friendly Captcha
7. Market research
8. Sharing personal data with suppliers and retail partners
9. Sharing personal data with regulatory authorities
10. Information about your rights with regard to data
11. Protecting your personal data
12. Data retention
13. About cookies and similar technologies
14. Links to other websites
15. Features of social media
16. Accessing and updating your personal data; and complaints
17. Legal basis for processing personal data
18. Changes to our notice
19. Key terms
20. Social media channels

1. What this Privacy Notice covers

The data controller is Hapag-Lloyd Cruises, a TUI Cruises GmbH company (referred to in this Notice as “we” or “us”), part of the TUI Group.

We are committed to doing the right thing when it comes to how we collect, use and protect your personal data. Your privacy matters to us, so please do take the time to read our Privacy Notice which explains:

• What types of personal data we collect and why we collect it.
• When and how we may share personal data with other organisations.
• The choices you have, including how to access and update your personal data.
   

We have tried to keep this Notice as simple as possible, but if you are not familiar with terms such as data controller, special categories of personal data, then read about these and some others in Key terms.

2. Personal data we collect

When you register for any of our services, you may provide us with:

3. Using your personal data

We use your personal data in a variety of ways, as explained below.

To provide the products and services you request

We need to process your personal data so that we can manage your account or booking, provide you with the products and services you want to buy and help you with any orders and refunds you may ask for. In detail, these are the following purposes in particular:

• Planning and organisation of the trip you have booked (cruise, shore excursion)
  Processing for the performance of a contract (Article 6, paragraph 1, point (b), of the GDPR)
• Transmission to the entrance and exit ports as part of the trip you have booked
  Processing for the performance of a contract (Article 6, paragraph 1, point (b), of the GDPR)
• Transmission to hotels and restaurants (possibly to third countries outside the EU)
  Processing for the performance of a contract (Article 6, paragraph 1, point (b), of the GDPR)
  (Article 49, paragraph 1, point (b), of the GDPR)
• Transmission to airlines (possibly to third countries outside the EU) when you book a travel package to and from departure and arrival points
  Processing for the performance of a contract (Article 6, paragraph 1, point (b), of the GDPR)
  (Article 49, paragraph 1, point (b), of the GDPR)
• Storage of name, telephone number and relationship for information purposes in case of emergency
  Legitimate interests (Article 6, paragraph 1, point (f), of the GDPR)
  Legitimate interest in the storage of this data consists in informing your relatives of unforeseen emergencies and, if necessary, in asking questions and initiating and/or coordinating measures in your interest.
• Use of telephone numbers, e-mail address and address for the purpose of customer support, i.e. to advise you and answer your questions in connection with your booked cruise
  Consent (Article 6, paragraph 1, point (a), of the GDPR)
  Processing for the performance of a contract (Article 6, paragraph 1, point (b), of the GDPR)
• Use of address and e-mail address for commercial communication (post and e-mail)
  Legitimate interests (Article 6, paragraph 1, point (f), of the GDPR)
  The legitimate interest consists in direct advertising for future cruises by sending catalogues and flyers with special cruise offers and/or in the context of an e-mail newsletter.
• Processing of relevant data in response to and management of security incidents, disturbances or other similar unforeseen occurrences on board. Among others, these can be of a medical or insurance-related nature.
  Processing in order to protect the vital interests of the data subject (Article 6, paragraph 1, point (d), of the GDPR)
  Legitimate interests (Article 6, paragraph 1, point (f), of the GDPR)
  The legitimate interest consists in being able to react to unforeseen events during the itinerary.
• Planning, organisation and support of the legally valid marriage, registered civil union or symbolic promise of marriage you have booked
  Processing for the performance of a contract (Article 6, paragraph 1, point (b), of the GDPR)

To manage and improve our products, services and day-to-day operations

In detail, these are the following purposes in particular:

• We use personal data to manage and improve our products, websites, customer loyalty or recognition programme(s) and other services.
  Legitimate interest (Article 6, paragraph 1, point (f), of the GDPR) The legitimate interest consists in providing you with an optimal user experience when using our tele-media services.
• We monitor how our services are used to help protect your personal data, detect and prevent fraud, other crimes and the misuse of services. This helps us to make sure that you can safely use our services.
  Legitimate interest (Article 6, paragraph 1, point (f), of the GDPR) The legitimate interest consists in protecting you and your personal data from criminal offences when using our services and recognising and preventing the misuse of services.
• We may use personal data to carry out market research and internal research and development, and to develop and improve our product range, services, shops, IT systems, security, know-how and the way we communicate with you.
  Legitimate interest (Article 6, paragraph 1, point (f), of the GDPR) The legitimate interest consists in developing and improving our product range, services, shops and IT systems, security, expertise and the methods of our communication with you.
• We use CCTV images to help maintain the safety of anyone working in or visiting our shops, premises and other buildings, and for the prevention, detection and prosecution of criminal offences. We may also rely on the images to establish, exercise or defend our legal rights.
  Legitimate interest (Article 6, paragraph 1, point (f), of the GDPR) The legitimate interest consists in identifying and preventing criminal offences and the misuse of services and being able to exercise and assert claims.

To personalise your experience

We want to provide you, as our customer, with even better support. In detail, these are the following purposes in particular:

• To do this, we may use your personal data to better understand your interests so that we can try to predict what other products, services and information you might be most interested in.
  Legitimate interest (Article 6, paragraph 1, point (f), of the GDPR) The legitimate interest consists in enabling us to tailor our communications to make them more relevant and interesting to you.
• Looking at your browsing behaviour and purchases helps us to better understand you as a customer.
  Legitimate interest (Article 6, paragraph 1, point (f), of the GDPR) The legitimate interest consists in enabling us to offer you personalised offers and services.
• We may also measure your responses to marketing communications relating to products and services we offer.
  Legitimate interest (Article 6, paragraph 1, point (f), of the GDPR) The legitimate interest consists in enabling us to offer you products and services that better meet your needs as a customer.
• If you do not want to receive a personalised service from us, you can change your preference online (kundendaten@hl-cruises.com), over the phone or by writing to us at any time. We will update our records as soon as we can.

To make contact and interact with you

We want to provide you, as our customer, with even better support. In detail, these are the following purposes in particular:

• When you contact us, for instance via e-mail, post, telephone or social media, we are permitted to use personal data in order to handle your matter in the best and fastest possible way.
  Consent (Article 6, paragraph 1, point (a), of the GDPR)
  Processing for the performance of a contract (Article 6, paragraph 1, point (b), of the GDPR)
• We need to process your personal data so that we can manage any promotions and competitions you choose to enter, including those we run with our suppliers and retail partners. For example, if you win a prize.
  Processing for the performance of a contract (Article 6, paragraph 1, point (f), of the GDPR)
  Legitimate interest (Article 6, paragraph 1, point (f), of the GDPR) The legitimate interest consists in enabling us to conduct the promotion and competition as well as notifying you of any winnings.
• If we have to process special categories of personal data, for example health-related data for medical reasons, we only do this if one or more additional prerequisites apply: we have your express consent; it is necessary to protect your vital interests or those of another person and you are physically or legally not in a condition to give consent; it is necessary for the justification, assertion or defence of legal claims; it is necessary for reasons of an overriding public interest.
  Article 9, paragraph 1, points (a), (c), (f) and (g), of the GDPR
• We are permitted to combine the data which we collect when you make a purchase in an online shop with personal data that was collected via our websites and other sources.
  Legitimate interests (Article 6, paragraph 1, point (f), of the GDPR)
  The legitimate interest consists in helping us better understand you as a customer and being able to provide you with services and marketing communications (including online advertising tailored to your interests).

We do not sell your personal data to third parties.

4. Marketing communications

From time to time we may send you relevant offers and news about our products and services in a number of ways, including by email. We may also send you information about other companies’ products and services that we believe may be of interest to you. We will only do this if you previously agreed to receive these marketing communications.

When you book or register with us we will ask if you would like to receive marketing communications. You can change your marketing preferences online, over the phone, using the ‘unsubscribe’ link in our marketing emails or by writing to us (e.g. email) at any time.

You may still receive service-related communications from us. For example, confirming bookings you make with us and providing important information about the use of our products or services.

Within the scope of our offer, we offer you the possibility at various points to be informed by us about interesting offers and news in various ways. Provided that you have given your express consent or that the requirements according to § 7 para. 3 UWG (Act against Unfair Competition, Germany) are fulfilled, we will use your email address and any additional voluntary personal details to send you our newsletter on a regular basis. When registering for a newsletter, you may be given the opportunity to provide additional information about yourself, for example if you would like to receive a birthday surprise. We will then process and use the data you provide for these purposes.

If you are no longer interested in receiving certain information or offers in the future or if you no longer wish to receive the information/offers via a certain channel, please inform us by email to datenschutz(at)hl-cruises.com. The unsubscribe function for the newsletter (opt-out link) is also integrated at the end of each email. We will then comply with your request immediately.

5. Provision of online services and web hosting

In order to provide our online services securely and efficiently, we use the services of one or more web hosting providers from whose servers (or servers they manage) the online services can be accessed. For these purposes, we may use infrastructure and platform services, computing capacity, storage space and database services, as well as security and technical maintenance services.

The data processed within the framework of the provision of the hosting services may include all information relating to the users of our online services that is collected in the course of use and communication. This regularly includes the IP address, which is necessary to be able to deliver the contents of online services to browsers, and all entries made within our online services or from websites.

Collection of Access Data and Log Files: We, ourselves or our web hosting provider, collect data on the basis of each access to the server (so-called server log files). Server log files may include the address and name of the web pages and files accessed, the date and time of access, data volumes transferred, notification of successful access, browser type and version, the user's operating system, referrer URL (the previously visited page) and, as a general rule, IP addresses and the requesting provider.

The server log files can be used for security purposes, e.g. to avoid overloading the servers (especially in the case of abusive attacks, so-called DDoS attacks) and to ensure the stability and optimal load balancing of the servers.

Processed data types:
Content data (e.g. text input, photographs, videos), Usage data (e.g. websites visited, interest in content, access times), Meta/communication data (e.g. device information, IP addresses).

Data subjects:
Users (e.g. website visitors, users of online services).

Legal Basis:
Legitimate Interests (Article 6 (1) (f) GDPR).

6. Friendly Captcha

Our website uses the service "Friendly Captcha" provided by Friendly Captcha GmbH, Am Anger 3-5, 82237 Wörthsee, Germany. Friendly Captcha is a data protection-friendly solution to make it more difficult for automated programs and scripts (so-called "bots") to use our website.

For this purpose, we integrated a program code from Friendly Captcha on our website, for example for contact forms, so that the visitor's device can establish a connection to the Friendly Captcha servers in order to receive a calculation task from Friendly Captcha. The visitor's device solves the calculation task and sends the calculation result to our web server. Our webserver contacts the Friendly Captcha server via API and receives a response as to whether the puzzle has been solved correctly by the visitor’s device. This way, we can assign security rules for our website and, for example, process or reject requests.

• The data is used exclusively to protect against spam and bots as described above.
• Friendly Captcha does not set or read any cookies on the visitor's device.
• IP addresses are only stored in hashed, i.e. one-way encrypted form and do not allow us or Friendly Captcha to draw any conclusions about an individual person.
• If personal data is stored, this data is deleted within 30 days.

The legal basis for the processing is our legitimate interest in protecting our website from abusive access by bots, i.e. spam protection and protection against attacks such as mass requests in accordance with Art. 6 para. 1 lit. f) GDPR.

7. Market research

We like to hear your views to help us to improve our products and services, so we may contact you for market research purposes. You always have the choice about whether to take part or continue in our market research.

8. Sharing personal data with suppliers and retail partners

In order to provide products or services requested by you we may share personal data with suppliers of your travel arrangements, including airlines, hotels and transport companies.

We also work with carefully selected suppliers that carry out certain functions on our behalf. For example, companies that help us with IT services, storing and combining data, marketing, market research, processing payments and delivering products and services. We may need to share personal data to establish, exercise or defend our legal rights; this includes providing personal data to others for the purposes of preventing fraud and reducing credit risk.

When we share personal data with other organisations we require them to keep it safe, and they must not use your personal data for their own marketing purposes.

We only share the minimum personal data that enable our suppliers and retail partners to provide their services to you and us.

For the purposes of performing the travel contract concluded with you, we transmit your personal data to, among others, the above-mentioned recipients in countries outside of the jurisdiction of European data protection laws for which the European Commission has determined that there is not an appropriate level of data protection. In particular, this transmission is carried out for the preparation of the cruise and is required due to local legal requirements to register passengers upon docking in ports. Some separate data protection agreements contracts exist with service providers who support us in carrying out the cruise. You can request copies of any existing data protection contracts from our data protection officer.

9. Sharing personal data with regulatory authorities

10. Information about your rights with regard to data

You have the right to information, correction, erasure or restriction of processing, data portability and objection to the processing of personal data concerning you. You also have the right to complain to a data protection authority. However, if you have questions or complaints, we ask that you first contact our corporate data protection officer at datenschutz(at)hl-cruises.com.

In the event that you have consented to us processing your personal data, you can withdraw this consent at any time. The processing of your data prior to the time you withdraw consent will remain lawful even if you do withdraw consent. If you would like to withdraw your consent, please write to kundendaten(at)hl-cruises.com and provide your customer number. Please note that, in the event of a withdrawal of your consent, processing may still be possible under certain circumstances on a legal basis, for example if this is necessary to fulfil a legal obligation or if there is a legitimate interest in further processing.

11. Protecting your personal data

We know how important it is to protect and manage your personal data. We take appropriate security measures to help protect your personal data from accidental loss and from unauthorised access, use, alteration and disclosure.

The security of your data also depends on you. For example, where we have given you or where you have chosen a password for access to certain services, you are responsible for keeping this password confidential.

The personal data that we collect from you may be transferred to, and stored at, a destination outside the European Economic Area ("EEA"). It may also be processed by organisations operating outside the EEA who work for us or for one of our suppliers. We put in place appropriate protections to make sure your personal data remains adequately protected and that it is treated in line with this Notice. These protections include, but are not limited to, appropriate contract clauses, such as standard contract clauses approved by the European Commission, and appropriate security measures.

12. Data retention

We will retain your personal data for only as long as it is necessary for the uses set out in this Privacy Notice and/or to meet legal and regulatory requirements. After this period, we will securely erase personal data. If data is needed after this period for analytical, historical or other legitimate business purposes, we will take appropriate measures to anonymise this data.

13. About cookiees and similar technologies

Cookies are small data files that allow a website to collect and store a range of data on your desktop computer, laptop or mobile device. Cookies help us to provide important features and functionality on our websites and mobile apps, and we use them to improve your customer experience. Please see our separate Cookie Notice.

14. Links to other websites

Our may contain links to websites operated by other organisations that have their own privacy notices. Please make sure you read the terms and conditions and privacy notice carefully before providing any personal data on another organisation’s website as we do not accept any responsibility or liability for websites of other organisations.

15. Features of social media

Our websites may contain features of social media such as Facebook, Twitter, Google+, YouTube, XING, LinkedIn, Instagram or Pinterest, which have their own respective data protection notices.

Please make sure that you read the terms of use and the data protection notice carefully before submitting any personal data, as we do not accept any responsibility or liability for these features.

We use the following plug-ins on our websites: Facebook, Twitter, YouTube, Instagram or Pinterest. If you do not want social networks to collect data about you via active plug-ins, you can select the “Block third-party cookies” function in your browser settings. The browser will then not send any cookies to the server for embedded content from other providers. However, with this setting, other cross-page functions may no longer work in addition to the plug-ins.

If these plug-ins are activated, your browser will establish a direct connection with the servers of the respective social network as soon as you access a page of our website. The content of the plug-in is transmitted directly from the social network to your browser, which integrates it into the website. By integrating the plug-ins, the social network receives the information that you have accessed the corresponding page of our website. If you are logged in to the social network, it can assign the visit to your account. If you interact with the plug-ins – for example, by clicking the Facebook “Like” button or posting a comment – the corresponding information is transmitted directly from your browser to the social network and stored there. Please refer to the data protection notices of the respective networks or websites for information on the purpose and scope of data collection and the further processing and use of the data by social networks, as well as your rights in this regard and the settings options for protecting your privacy. You will find the links below.

Even if you are not logged into social networks, data can be sent to the networks by websites with active social plug-ins. An active plug-in sets a cookie with an identifier each time the website is accessed. Since your browser creates a profile with each connection to a network server, it is possible to determine which websites the user associated with the identifier has accessed. It would be possible to match this identifier to a person when they later log in to the social network.

Integration of Facebook social plug-ins

Our website includes social plug-ins (“plug-ins”) from the social network facebook.com, which is operated by Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA (“Facebook”). For information on the purpose and scope of data collection and the further processing and use of the data by Facebook, as well as your rights in this regard and setting options for protecting your privacy, please refer to Facebook’s data protection information: http://www.facebook.com/policy.php. You can also block Facebook social plug-ins with add-ons for your browser – for example, with the Facebook blocker.

Integration of YouTube

Our website uses content from the Google-owned site YouTube (videos integrated into the website). The site is operated by YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. If you visit one of our pages that has a YouTube plug-in, a connection to the YouTube servers is established. In doing so, the YouTube server is informed which pages of ours you have visited.

If you are logged into your YouTube account, you enable YouTube to directly assign your surfing behaviour and/or the videos viewed to your personal profile. You can prevent this by logging out of your YouTube account.

Further information about the handling of user data can be found in YouTube’s privacy policy at: https://policies.google.com/privacy.

Integration of Twitter plug-ins

Our website integrates social plug-ins (“plug-ins”) from the social network Twitter which is operated by Twitter Inc., 795 Folsom St., Suite 600, San Francisco, CA 94107, USA (“Twitter”). For information on the purpose and scope of data collection and the further processing and use of the data by Twitter, as well as your rights in this regard and setting options for protecting your privacy, please refer to Twitter’s data protection information: twitter.com/privacy.

Integration of Pinterest plug-ins

This website also integrates plug-ins from the social network Pinterest Inc., 635 High Street, Palo Alto, CA, 94301, USA (“Pinterest”). You can recognise the Pinterest plug-in by the “Pin it” button on our site. If you click on the Pinterest “Pin it” button while you are logged into your Pinterest account, you can link the contents of our pages to your Pinterest profile. This allows Pinterest to assign your visit to our pages with your user account. Please note that we do not receive any information about the content of the transmitted data or its use by Pinterest. For more information, please see Pinterest’s privacy policy: about.pinterest.com/privacy.

Integration of Instagram plug-ins

This website also includes plug-ins from the social network Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA (“Instagram”). You can recognise the Instagram plug-in by the Instagram button on our site. If you click on the Instagram button while you are logged into your Instagram account, you can link the contents of our pages to your Instagram profile. This allows Instagram to assign your visit to our pages with your user account. We would like to point out that we do not receive any information about the content of the transmitted data or its use by Instagram. For more information, please see Instagram’s privacy policy: instagram.com/about/legal/privacy.

You have a right to ask for a copy of the personal data we hold about you. You can write to us asking for a copy of other personal data we hold about you.

Please include any details to help us identify and locate your personal data. Where we can provide data access, we will do so free of charge except where further copies are requested in which case we may charge a reasonable fee based on administrative costs.

We want to make sure that the personal data we hold about you is accurate and up to date. If any of the details we hold are incorrect, please let us know.

You can also ask for your personal data to be rectified or erased, to object to the processing of your personal data and, where technically feasible, to ask for personal data you provided to be transmitted to another organisation.

We will update or erase your data, unless we have to keep it for legitimate business or legal purposes.

You can also contact us if you have a complaint about how we collect, store or use your personal data. We aim to resolve complaints but if you are dissatisfied with our response, you may complain to the local data protection authority https://www.datenschutz-hamburg.de/.

Please submit your request or complaint in writing to the Legal Department/Data Protection Officer:

Hapag-Lloyd Cruises, a TUI Cruises GmbH company, Datenschutz, Heidenkampsweg 58, 20097 Hamburg, Germany

Email: datenschutz(at)hl-cruises.com

Please note that we may ask you to verify your identity before we can act on your request or complaint. We may also ask you for more information to help ensure that you are authorised to make such a request or complaint when you contact us on behalf of someone else.

17. Legal basis for processing personal data

We will only collect and use your personal data if at least one of the following conditions applies:

• We have your consent;
   Example: Booking
   You give us permission to process your personal data when you book a trip.

• It is necessary for a contract with you or to take steps at your request prior to entering into a contract;
  Example: To provide the products and services you request
  We need to process your personal data so that we can manage your booking, provide you with the products and services you want to buy and help you with any orders and refunds you may ask for.

• It is necessary for us to comply with a legal obligation;
  Example: Sharing personal data with regulatory authoritiesSo that you can travel, it may be mandatory (as required by government authorities at the point(s) of departure and/or destination) to disclose and process your personal data for immigration, border control, security and anti-terrorism purposes, or any other purposes which they determine appropriate.

• It is necessary to protect your vital interests or those of another individual;
  Example: In an emergencyYour insurance company, their agents and medical staff may exchange relevant personal data and special categories of personal data with us in circumstances where we/they need to act on your behalf or in the interest of other customers or in an emergency.

• It is in the public interest or we have official authority; 
  Example: Security operationsWe may use personal data to respond to and to manage security operations, accidents or other similar incidents, including medical and insurance purposes.

• It is in our or a third party’s legitimate interests and these are not overridden by your interests or rights.
  Example: To personalise your experienceWe may use your personal data to better understand your interests so that we can try to predict what other products, services and information you might be most interested in. This enables us to tailor our communications to make them more relevant and interesting for you.

Where we need to process special categories of personal data, for example health data for medical reasons, we will only do so if one or more additional conditions apply. For example, we have your explicit consent; it is necessary to protect the vital interests of you or another individual and you are physically or legally incapable of giving consent; it is necessary to establish, exercise or defend legal claims; it is necessary for reasons of substantial public interest.

18. Changes to our Notice

This Notice replaces all previous versions. We may change the Notice at any time so please check it regularly on our website(s) for any updates. If the changes are significant, we will provide a prominent notice on our website(s) including, if we believe it is appropriate, electronic notification of Privacy Notice changes.

Last update: April 2020

19. Key terms

Data controller: The data controller determines the purpose and manner in which personal data is used.

European Economic Area (EEA): EU Member States plus Norway, Iceland and Lichtenstein.

Online advertising: Marketing messages that you may see on the internet.

Special categories of personal data: This are categories of personal data revealing racial or ethnic origin; political opinions; religious or philosophical beliefs; trade union membership; genetic data, biometric data for the purpose of uniquely identifying a natural person; health data; and data concerning a natural person’s sex life or sexual orientation.

Caricom API Data: Some or all of the Caricom states have entered into an agreement with the USA whereby advance passenger data, required by and provided to Caricom states for border security purposes, will be passed to the USA Department for Homeland Security for processing on behalf of those Caricom states. Please see the Caricom website Caricom webseitef or more details.

US Secure flight Data: The Transportation Security Administration (TSA) requires you to provide your full name, date of birth and gender for the purpose of watch list screening. You may also provide your Redress Number, if available. Failure to provide details may result in denial of transport or denial of authority to enter the boarding area. TSA may share information you provide with law enforcement or intelligence agencies or others under its published system of records notice. Please see the TSA webseite for more details.

20. Social media channels

Thank you for your interest in the social media profiles of Hapag-Lloyd Cruises, provided by Hapag-Lloyd Cruises, a TUI Cruises GmbH company.

We have the following social network channels:

• Facebook: https://www.facebook.com/HLCruises/ https://www.facebook.com/HLCruisesInt/
• Instagram: www.instagram.com/hapaglloydcruises/
• X: x.com/HLCruises x.com/HLCruisesInt
• Pinterest: www.pinterest.de/hlcruises/
• YouTube: https://www.youtube-nocookie.com/channel/UCRJ3IId3bA_LvMK3Evj38WA
• LinkedIn: www.linkedin.com/company/hapaglloydcruises/

Please note that by registering for the social networks, you also agree to the privacy policies of the networks in question that also apply to services such as our profiles.

Data processing and intended purpose
We take the protection of your personal data on the social networks very seriously and want you to be aware of how and why your data are stored or used.

Personal data include your name, date of birth, email address and phone number. We and the companies operating on our behalf only collect and process the personal data concerning you that we obtain from you through our social media channels for the purposes of communication and only insofar as necessary for the purposes of our profiles. Specifically, we process data in the following instances:

• If you contact us by sending us a direct message; in this case, we will store and process your data – primarily your name – in order to respond to your enquiry.
   

We will erase these data after the end of the communication. The storage periods of the networks might deviate from this. The personal data you transmit to us through direct messages and contact forms will not be disclosed to third parties by us.

Please note that other users can see what you post on our profiles and how you interact with our pages, i.e. what posts you share or “Like” and so on.

If we post links to third-party websites, this privacy policy does not apply to those links.

Addendum: data processing on Facebook
Your personal data will be collected if you visit our Facebook page. If you are logged in, the data will be your Facebook profile data. In any case, the data will include your IP address and browser information.

The data will be processed by Facebook and by us as joint controllers. The data are processed on the basis of point (f), Article 6, paragraph 1, of the European General Data Protection Regulation (GDPR; our legitimate business and communicative interests in the provision of an information and communication channel on social media, in this case Facebook).

1. About cookies and similar technologies
2. Online Marketing
3. Your choices when it comes to cookies
4. Changes to our Notice
5. Our cookies

1. About cookies and similar technologies

Cookies are small data files that allow a website or a mobile app to collect and store a range of data on your desktop computer, laptop or mobile device. Cookies help us to provide important features and functionality on our websites and mobile apps, and we use them to improve your customer experience. With our permission, cookies may be placed on our websites and mobile apps by other organisations. For example, we use cookies to do the following:

To improve the way our websites work

Cookies allow us to assess and improve the way our websites work so that we can personalise your experience and allow you to use many of their useful features. For example, cookies help us to keep track of what you are booking as you move through each stage of the booking process; they help us to remember your preferences such as recent searches or shortlisted holidays, and the contents of your online shopping basket.

To improve the performance of our websites

Cookies can help us to understand how our websites are being used, for example, by telling us if you get an error messages as you browse, to test different designs of our website pages. Website analytics, including Google Analytics, provides information about the number of visitors to our website, which parts of our website are most popular and if there are any trends such as one specific page being viewed mostly by people in a particular country. These cookies help us to improve your experience.


To deliver relevant online advertising

We use cookies to help us deliver online advertising that we believe is most relevant to you on our websites, mobile apps and other organisations’ websites. For example, these cookies help us to suggest flights from your nearest airport, holidays in destinations you have shown interest in or products you might like.
These cookies may collect data about your online behaviour, such as your IP address, the website you arrived from and information about your purchase history or the content of your shopping basket.
This means that you may see our adverts on our websites, mobile apps and on other organisations’ websites. You may also see adverts for other organisations on our websites and mobile apps.
To help us to deliver online advertising that is relevant to you, we may also combine data we collect through cookies in the browser of your devices with other data that we have collected.

To measure the effectiveness of our marketing communications, including online advertising
Cookies can tell us if you have seen a specific advert, and how long it has been since you have seen it. This information allows us to measure the effectiveness of our online advertising campaigns and control the number of times you are shown an advert so it does not become too repetitive. We also use cookies to measure the effectiveness of our marketing communications, for example by telling us if you have opened a marketing email that we have sent you.

2. Online-Marketing

We process personal data for the purposes of online marketing, which may include in particular the marketing of advertising space or the display of advertising and other content (collectively referred to as "Content") based on the potential interests of users and the measurement of their effectiveness.

For these purposes, so-called user profiles are created and stored in a file (so-called "cookie") or similar procedure in which the relevant user information for the display of the aforementioned content is stored. This information may include, for example, content viewed, websites visited, online networks used, communication partners and technical information such as the browser used, computer system used and information on usage times. If users have consented to the collection of their sideline data, these can also be processed.

The IP addresses of the users are also stored. However, we use provided IP masking procedures (i.e. pseudonymisation by shortening the IP address) to ensure the protection of the user's by using a pseudonym. In general, within the framework of the online marketing process, no clear user data (such as e-mail addresses or names) is secured, but pseudonyms. This means that we, as well as the providers of online marketing procedures, do not know the actual identity of the users, but only the information stored in their profiles.

The information in the profiles is usually stored in the cookies or similar memorizing procedures. These cookies can later, generally also on other websites that use the same online marketing technology, be read and analyzed for purposes of content display, as well as supplemented with other data and stored on the server of the online marketing technology provider.

Exceptionally, clear data can be assigned to the profiles. This is the case, for example, if the users are members of a social network whose online marketing technology we use and the network links the profiles of the users in the aforementioned data. Please note that users may enter into additional agreements with the social network providers or other service providers, e.g. by consenting as part of a registration process.

As a matter of principle, we only gain access to summarised information about the performance of our advertisements. However, within the framework of so-called conversion measurement, we can check which of our online marketing processes have led to a so-called conversion, i.e. to the conclusion of a contract with us. The conversion measurement is used alone for the performance analysis of our marketing activities.

Unless otherwise stated, we kindly ask you to consider that cookies used will be stored for a period of two years.

Information on legal basis:
If we ask users for their consent (e.g. in the context of a so-called "cookie banner consent"), the legal basis for processing data for online marketing purposes is this consent. Otherwise, user data will be processed on the basis of our legitimate interests (i.e. interest in the analysis, optimisation and economic operation of our online services. In this context, we would also like to refer you to the information on the use of cookies in this privacy policy.

Services and service providers being used

Google Tag Manager
Google Tag Manager is a web tag management solution that allows us to manage website tags through a single interface (including Google Analytics and other Google marketing services in our online services). The Tag Manager itself (which implements the tags) does not process any personal user data. With regard to the processing of users' personal data, reference is made to the information below regarding Google services.
Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Website: marketingplatform.google.com; Privacy Policy: policies.google.com/privacy.

Google Analytics
Google Analytics, a web analytics service provided by the third-party provider Google Ireland Limited (a company incorporated and operated under Irish law (registration number: 368047) with its registered office at Gordon House, Barrow Street, Dublin 4, Ireland), is used for the purposes of designing the website to meet requirements, measuring reach, analyzing the general usage behavior of users on the website and optimizing economic operations. Google Analytics uses so-called “cookies”. The information generated by the cookie about your use of our website (including your IP address) will be transmitted to and stored on servers of Google.

The use of Google Analytics is the joint responsibility of Google and the website operator. An agreement on data processing has been concluded with Google for this purpose, which currently assigns full responsibility to both parties for the processing assigned to them. Google merges your usage data with usage data collected elsewhere and uses the resulting profiles to display personalized advertising and to provide analyses. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide the website operator with other services relating to website activity and internet usage.
The data processed by Google includes your device settings and device data, the exact usage times of individual elements of this site and thus your usage behaviour, Further information on the use of data by Google, setting and objection options can be found on the Google websites: policies.google.com/technologies/partner-sites;(‘Data use by Google when you use our partners’ websites or apps") policies.google.com/technologies/ads („Technologies and principles / Advertising“) adssettings.google.com/authenticated; („Settings for advertising“)
The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data. You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website.

You can also prevent Google from collecting the data generated by the cookie and relating to your use of the website (including your IP address) and from processing this data by Google by downloading and installing the browser plug-in available under the following link: https://tools.google.com/dlpage/gaoptout.

Please note that the use of the browser plugin is limited to the respective browser and also to the respective computer and may not be deactivated or deleted after installation in order to maintain the deactivation of Google Analytics. Google's privacy policy can be viewed at https://policies.google.com/privacy.

Newsletter
See above Marketing communications

Cleverpush

When you visit our website, you can sign up to receive push notifications. To send push notifications, we use the provider CleverPush, which is operated by CleverPush GmbH, Heidenkampsweg 100, 20097 Hamburg, Germany.

You will regularly receive information via our push notifications – for example, about promotions and new catalogues that have been published.

To opt in, you must confirm your browser's request to receive notifications. This process is documented and stored by CleverPush. This includes saving the opt in time and your browser ID or device ID. The collection of this data is required so that we can understand the processes in case of misuse and therefore serves our legal protection.

To show you the push notifications, CleverPush collects and processes your browser ID on our behalf and your device ID in the case of mobile access.

By subscribing to our push notifications, you agree to their receipt. Legal basis for the processing of your data after registration for our push notifications is in the presence of your consent Art. 6 para. 1 lit. a GDPR. CleverPush also statistically evaluates our push notifications. CleverPush can detect if and when our push notifications were displayed and clicked by you.

Your consent to the storage and use of your personal information to receive our push notifications and the statistical survey described above may be revoked at any time with future effect. To revoke consent, you can change the setting to receive push notifications in your browser. If you use our push notifications on a desktop PC with the operating system "Windows", you can also unsubscribe our push notifications by right-clicking on the respective push notification in the settings that appear there.

Your data will be deleted as soon as they are no longer necessary to achieve the purpose of their survey. Your data will be stored as long as the subscription to our push notifications is active.

Under the following link, the process of unsubscribing will be explained in detail: https://cleverpush.com/faq

3. Your choices when it comes to cookies

You can use your browser settings to accept or reject new cookies and to delete existing cookies. You can also set your browser to notify you each time new cookies are placed on your computer or other device. You can find more detailed information about how you can manage cookies at the All About Cookies and Your Online Choices websites.

If you choose to disable some or all cookies, you may not be able to make full use of our websites or mobile apps. For example, you may not be able to add items to your shopping basket, proceed to checkout, or use any of our products and services that require you to sign in.

Where we display personalised adverts on other organisations’ websites, the AdChoices icon will usually be displayed. Clicking on this icon will provide you with specific guidance on how to control your online advertising preferences. More information is available on the YourAdChoices website.

4. Changes to our Notice

This Notice replaces all previous versions. We may change the Notice at any time so please check it regularly on our website(s) for any updates. If the changes are significant, we will provide a prominent notice on our website(s) including, if we believe it is appropriate, electronic notification of Cookie Notice changes..

Last update: April 2020

5. Our cookies

Technically necessary cookies

These cookies are necessary for the functioning of the website and therefore cannot be deactivated. They are used, for example, to save your data protection settings. You can set your browser to block these cookies. However, this will result in some areas of our website no longer functioning.

hlkf_is_agency

Set by Hapag-Lloyd Cruises. Is necessary to deliver tailor-made offers to partner travel agencies. Duration: 300 days

PHPSESSID

Set by Hapag-Lloyd Cruises Is necessary, for example, to keep form data entered on the website over several steps. Duration: Session

zil_user

Set by Hapag-Lloyd Cruises Is necessary to check if the user is logged in. If the check shows that the user is not logged in, he will be redirected to the login page. Duration: 5 years

REMEMBERME

Set by Hapag-Lloyd Cruises Is necessary so that a user is recognised on the website if he has activated the "Stay logged in" function. Duration: 7 days

OptanonConsent

Is used by OneTrust. Saves which cookies you have agreed to on our website. The cookie contains no personal information. Duration: 1 year.

OptanonAlertBoxClosed

Is used by OneTrust. Contains a timestamp of when the approval was given. Duration: 1 year.

Statistics cookies

These cookies help us to understand the behaviour of our website visitors and make our website even better for you.

Marketing Cookies
We use marketing cookies to determine your interests and adapt advertisements to your personal needs. In addition, we use marketing cookies to measure the effectiveness of advertisements.

They enable us to send you offers as push notifications.

_cfduid

Used by CleverPush. Cloudflare uses _cflb, _cf_bm and _cfduid cookies to maximise network resources, manage traffic and protect our websites from malicious traffic. Duration: 30 days

Third-party services (joint responsibility or third-party providers under their own responsibility)
Hapag-Lloyd Cruises collaborates with third-party companies. These service providers offer services in which data is either used under their own responsibility or under joint responsibility with Hapag-Lloyd Cruises. You can find separate information on this in our data protection information under "Privacy notice / online marketing".

_ga

Is used by Google Analytics. Creates a unique, randomly generated user ID that is used to identify the visitor and expires after 2 years. This makes it possible, for example, to recognize returning visitors.

_gat

Is used by Google Analytics. This cookie does not store any user data. It serves to minimize the queries to Google. Duration: 1 minute

_gid

Is used by Google Analytics. Similar to the _ga cookie. Contains a unique, randomly generated user ID that is used to identify user behavior. Duration: 1 day