Privacy Policy
1. General
We take the protection of your personal data very seriously. Data is processed by us in accordance with applicable legal data protection regulations, and from May 25, 2018, in particular, according to the European General Data Protection Regulation (hereinafter referred to as GDPR) as well as country-specific data protection regulations. “Processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
“Personal data” means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Below, we inform you about the processing of your data, in particular about the type, scope, and purposes of the collection and use of your personal data when you visit our website and use our offers and services, as well as the corresponding legal bases for the individual processing operations. Furthermore, within the framework of our privacy policy, we explain to you what rights you have regarding data processing.
2. Controller for Data Processing
As the provider of our online services, we are the entity responsible for data processing. You can reach us using the contact details below:
Final Escape 2.6 GmbH
Braunstraße 3
23552 Lübeck
Telephone: 0451 120 152 40
Email: luebeck@final-escape.de
3. Processing of your data
The type, scope and purposes of processing your data differ depending on whether you only visit our website or use services and/or other offerings provided by us:
a) Visiting our website (server log files)
When you visit our website, the server stores data in so-called server log files that your internet browser automatically transmits to the server, in particular:
- Date and time of access to one of our web pages
- Your browser type and the respective browser version
- The operating system used
- The last page you visited (so-called referrer URL)
- The amount of data transferred and the access status (file transferred, file not found, etc.) as well as
- Your IP address and the requesting provider.
This data is processed to enable the use of the web pages you access, for statistical purposes, to improve our website, and for security against unlawful cyberattacks, as well as to exercise, assert, or defend legal claims. Your IP address is stored only as long as necessary to defend against possible cyberattacks and to provide law enforcement authorities with the information necessary for prosecution.
The data specified above is processed separately from all personal data that you provide to us when visiting our websites and/or using a service or offering, and is never merged.
From May 25, 2018, the legal basis for the data processing described above is Article 6(1)(b) GDPR for the implementation of necessary pre-contractual measures to enable you to use the web pages you access. Insofar as the aforementioned data is processed for security against unlawful cyberattacks, or to exercise, assert, or defend legal claims, this is done from May 25, 2018, on the legal basis of Art. 6(1)(f) GDPR. Our legitimate interest for this data processing lies in the evaluation of data to improve our website, to exercise, assert, or defend legal claims if necessary, and to protect our systems from unlawful cyberattacks.
b) Processing of personal data when using the services and/or offerings provided by us:
Personal data is only processed by us if this is legally permitted or if you consent to the processing of your personal data.
If you wish to use the services and offerings provided by us on our website, it may be necessary for you to transmit further personal data. The data we absolutely require can be seen from the contact or booking forms. You can voluntarily provide additional information that is not absolutely necessary for the purposes described above; this information is marked accordingly by us during data collection within the registration or ordering process.
We process your personal data for the aforementioned purposes from May 25, 2018, on the legal basis of Article 6 (1) (b) GDPR to fulfill a contract with you or to carry out necessary pre-contractual measures that are taken at your request. The purpose of processing your personal data is therefore, for example, to process inquiries or to provide the desired service. Without providing the personal data, we cannot process your request and/or conclude the contract with you and cannot provide the offered services and offerings.
Furthermore, we process your data for the purpose of exercising, asserting, or defending legal claims arising from the contractual relationship, if necessary, and to enable law enforcement authorities to prosecute misuse of our services, if necessary. The aforementioned data processing takes place from May 25, 2018, on the legal basis of Art. 6(1)(f) GDPR. Our legitimate interest for data processing on the legal basis of Art. 6(1)(f) GDPR lies in being able to exercise, assert, or defend legal claims arising from the contractual relationship, if necessary, and to enable law enforcement authorities to prosecute, if necessary.
We also process your personal data for the purpose of complying with our legal retention obligations. The legal basis for fulfilling our legal retention obligations is stipulated in Article 6(1)(c) GDPR from May 25, 2018.
Your data may be passed on to service providers supporting us for the fulfillment of the contract or for the implementation of necessary pre-contractual measures taken at your request, which we have, of course, carefully selected. These may be technical service providers or service providers supporting us with shipping, payment processing, or accounting. The transfer of your personal data in the cases described above takes place from May 25, 2018, either on the legal basis of Article 6 (1) (b) GDPR for the fulfillment of a contract with you or for the implementation of pre-contractual measures taken at your request, or on a proper contract for processing on behalf, which meets the requirements of Article 28 GDPR.
Your personal data may also be transferred via third-party tools (programs) that we use on our website. If you access and use our website, your IP address and other data may be forwarded to third-party servers so that the content you access can be sent from the third-party provider to your browser. The processing of your data by the third-party content provider is subject to their privacy policies. We will inform you about the use, functionality, and other details of the respective third-party tools that we use on our website in this privacy policy.
Otherwise, your personal data will only be transferred to other third parties if we are legally obliged to do so (e.g., to authorities to clarify cyberattacks and any committed crimes or to tax authorities to comply with tax obligations or to courts in the event of legal disputes) from May 25, 2018, on the legal basis of Article 6(1)(c) GDPR, and if necessary, to lawyers and tax advisors on the legal basis of Article 6(1)(c) GDPR or Article 6(1)(f) GDPR. Our legitimate interest in transferring your data to lawyers is to exercise, assert, or defend legal claims. Our legitimate interest in transferring your data to external tax advisors is to properly fulfill our tax obligations.
4. Use of Cookies
We use so-called “cookies” on our website. Cookies are small text files that are sent from our web server to your browser during your visit to our websites and are stored by it temporarily on your device (e.g., PC, smartphone, tablet) for various purposes. Below, we inform you about the use of cookies on our website:
a) Session Cookies and Permanent Cookies
We use session cookies on our site, which are set when the homepage is accessed and are only valid until your browser is closed again. In addition, we use so-called “permanent cookies” on our site, which are automatically deleted after 12 months at the latest. The purpose of the session and permanent cookies used by our website is to enable you to use our website more effectively and to collect statistical data about our website, analyze it, and improve it. “Permanent cookies” also make it possible to recognize a device when you revisit our website and to store information about your last visit. We only use permanent cookies that are automatically deleted after 12 months at the latest. User profiles are not created by the cookies we set.
b) Third-Party Cookies
Cookies may also be used by third-party tool providers (programs) that we use on our website. If we use third-party tools, we will inform you about their use, functionality, and other details in section 15 of this privacy policy.
c) Preventing the Use of Cookies through Browser Settings
You can determine whether cookies can be set and accessed yourself through your browser settings. For example, you can deactivate the storage of cookies altogether in your browser, restrict it to certain websites, or configure your browser to automatically notify you as soon as a cookie is to be set and ask for your permission. You can also set your browser to automatically delete cookies when the browser is closed. Finally, you can activate a Do-Not-Track function (“DNT”) in your browser, so that you are automatically not recorded by any web analysis tool that may be used. Information on configuring your browser settings can be found in the help function of your respective internet browser.
5. Storage and Deletion Periods for Personal Data
If the processing purpose for your respective personal data ceases, your personal data processed by us will be routinely deleted or blocked, unless you have consented to the permanent storage of your personal data.
If individual data must be retained after the processing purposes cease due to legal retention periods (e.g., tax and commercial law retention regulations), the data will be blocked instead of deleted. The data to be retained may then be processed exclusively for the aforementioned purposes on the legal basis of Article 6(1)(c) GDPR.
6. Your Rights as a Data Subject
You have the rights described below at any time:
- Right to confirmation and information about the personal data processed by us in accordance with Article 15 GDPR
- Right to rectification of your personal data in accordance with Article 16 GDPR
- Right to erasure of your personal data (“right to be forgotten”) in accordance with Article 17 GDPR
- Right to restriction of processing of your personal data in accordance with Article 18 GDPR
- Right to data portability of your personal data in accordance with Article 20 GDPR
- In accordance with Article 22 GDPR, you have the right not to be subject to a decision based solely on automated processing – including profiling – which produces legal effects concerning you or similarly significantly affects you.
Please send your request to the contact details provided in section 2 of this privacy policy.
7. Right to Object
You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Article 6(1)(e) or (f) GDPR from May 25, 2018; this also applies to profiling based on these provisions.
In this case, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defense of legal claims.
Where personal data are processed for direct marketing purposes, you shall have the right to object at any time to processing of personal data concerning you for such marketing; this also applies to profiling to the extent that it is related to such direct marketing.
You also have the right, on grounds relating to your particular situation, to object to processing of personal data concerning you for scientific or historical research purposes or statistical purposes pursuant to Article 89(1) GDPR, unless the processing is necessary for the performance of a task carried out for reasons of public interest. If you object to processing for direct marketing purposes, the personal data will no longer be processed for these purposes.
8. Right to Withdraw Consent
You can withdraw any data protection consent explicitly given to us at any time with effect for the future. The lawfulness of the processing carried out based on the consent until withdrawal is not affected by the withdrawal.
9. Obligation to Notify in Connection with the Rectification or Erasure of Personal Data or the Restriction of Processing
If you believe that your data protection rights are being violated, you can contact the supervisory authority of your federal state or the federal state of our company headquarters. If a complaint concerns a company based in another federal state, the supervisory authority forwards the complaint to the competent supervisory authority there.
10. Notification Obligation in Connection with the Rectification or Erasure of Personal Data or the Restriction of Processing
We shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18 GDPR to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. We will inform you about those recipients if you request it.
11. Legal or Contractual Provisions for the Provision of Your Personal Data, as well as Information on the Necessity for Concluding a Contract and Your Obligation to Provide Personal Data and Possible Consequences of Non-Provision:
As described above, we collect and process your personal data in particular for the fulfillment of a contract with you or for the implementation of pre-contractual measures taken at your request. In some cases, the provision of personal data when concluding contracts (e.g., for invoices) is legally required due to tax and/or commercial law regulations; otherwise, it is a contractual or pre-contractual obligation. If you do not provide us with personal data, we will not be able to conclude a contract with you and/or answer your inquiries.
Insofar as we process your personal data on the basis of a legitimate interest pursuant to Art. 6 (1) (f) GDPR, the provision of your data for these purposes is neither contractually nor legally required. The details of data processing on the basis of a legitimate interest can be found in the information in this privacy policy at the respective points. If you do not provide us with personal data for these purposes, this may result in you not being able to use our website and services, or not being able to use them to their full extent.
12. Automated Individual Decision-Making, Including Profiling
We do not use automated decision-making – including profiling in accordance with Article 22(1) and (4) of the GDPR.
13. Data Security
We implement technical and organizational security measures to protect the processing of personal data, in particular against accidental or intentional manipulation, loss, destruction, or against attack by unauthorized persons. Our security measures are continuously improved in line with technological developments.
14. Questions / Comments
You are welcome to address questions or comments about this privacy policy or data protection in general to our contact details, which you can find in section 2 of this privacy policy.
15. Use of Third-Party Tools and Content
We currently use tools from the following third-party providers:
Google Analytics
It is important to us to design our websites as optimally as possible and thus make them attractive to our visitors. For this, it is necessary that we know which parts of our website are popular with our visitors.
For this purpose, we use the web analysis service Google Analytics, a web analysis service of Google Inc. (“Google”), on our website. Google Analytics uses so-called “cookies”, text files that are stored on your computer and enable an analysis of your use of the website. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there.
We use Google Analytics on this website with IP anonymization activated, meaning your IP address will be truncated by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity, and to provide other services related to website activity and internet usage to the website operator. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.
You can prevent the storage of cookies by setting your browser software accordingly. Information on configuring your browser settings can be found in the help function of your respective internet browser. However, we would like to point out that in this case, you may not be able to use all functions of this website to their full extent.
Furthermore, you can prevent the collection of data by a browser plugin. This plugin sets an opt-out cookie and thus prevents the future collection and processing of your data by Google Analytics. You can download and install a browser plugin at the link http://tools.google.com/dlpage/gaoptout?hl=de.
You can also prevent the collection by Google Analytics by clicking on the following link to “Deactivate Google Analytics” [Link to activate the opt-out cookie]. An opt-out cookie will be set that prevents the future collection of your data when visiting this website:
Further information on Google’s terms of use and data protection can be found at http://www.google.com/analytics/terms/de.html and at http://www.google.de/intl/de/policies/terms/regional.html.
The use of Google Analytics described above takes place from May 25, 2018, on the basis of Art. 6(1)(f) GDPR. Our legitimate interest in analyzing user behavior is to optimize our website and market our services optimally.
YouTube Videos
We embed videos from the “YouTube” service, a service of YouTube LLC, 901 Cherry Ave, San Bruno, CA 94066, USA, on our website in extended data protection mode.
YouTube videos are not stored on our own server, but on YouTube’s servers. According to YouTube’s own statements, when a YouTube video is embedded, no information about visitors to a website is stored by YouTube unless a visitor watches the embedded video. In this case, YouTube sets cookies to collect video statistics, prevent fraud, and improve user-friendliness, and stores your IP address. Contact is also made with Google’s advertising network “DoubleClick” when a video is watched. As soon as an embedded YouTube video is started, we no longer have any influence on this data processing by YouTube. Further information on data protection at YouTube can be found in their privacy policy at:
http://www.youtube.com/t/privacy_at_youtube
The use of YouTube described above takes place from May 25, 2018, on the basis of Art. 6(1)(f) GDPR. Our legitimate interest in embedding YouTube videos is to optimize our website and market our services.
Facebook “Custom Audiences”
This website uses the remarketing function “Custom Audiences” of Facebook Inc. (“Facebook”). This function helps us track and analyze statistical data about our Facebook ads to optimize our future advertising measures. The data collected is anonymous to us as the operator of this website; we cannot draw conclusions about the identity of the users.
The Facebook pixel uses a cookie, stored for 3 months, for the unique identification of the user and the browser.
The data is also stored and processed by Facebook, so that a connection to the respective user profile on Facebook is possible and Facebook can use the data for its own advertising purposes, in particular for interest-based advertisements (“Facebook Ads”). We have no influence on this data processing by Facebook.
Further information on the use of cookies and Custom Audiences by Facebook can be found in their privacy policy at:
https://www.facebook.com/policies/cookies
https://www.facebook.com/about/privacy
The use of Facebook Custom Audiences technology described above takes place from May 25, 2018, based on our legitimate advertising interests and thus on the legal basis of Article 6(1)(f) GDPR.
Instagram Functions
This website uses functions and content of the Instagram service from Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA. We use Instagram’s functions to present content such as videos, images, and texts on our website and to give users the opportunity to subscribe to and recommend the content to other users.
The Instagram functions set session cookies and can therefore potentially assign the access to our Instagram content to a user’s Instagram profile. We have no influence on this data processing by Instagram.
Information on the type, scope, and purpose of the collection and use of personal data by Instagram, as well as your related rights and setting options for protecting your privacy, can be found in Instagram’s privacy policy:
http://instagram.com/about/legal/privacy/.
If you do not wish for the aforementioned data transfers to Instagram, we recommend that you disable JavaScript in your browser and deactivate the storage of cookies and delete existing cookies from your browser before visiting our websites. Information on configuring your browser settings can be found in the help function of your respective internet browser.
The use of Instagram functions described above takes place from May 25, 2018, based on our legitimate business advertising interests and thus on the legal basis of Article 6(1)(f) GDPR.
Facebook Plug-Ins
We use programs (so-called “plug-ins”) from Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA (hereinafter referred to as Facebook) on our websites. The following applies in this regard:
You recognize these plug-ins by Facebook’s logos (white “f” on a blue tile or a “thumbs up” sign) and/or the corresponding additions “Gefällt mir”, “I Like” or the designation “Facebook Social Plugin”.
When you visit one of our web pages on which a Facebook plug-in is used, a direct connection between your browser and Facebook is established, provided you activate this function via a corresponding activation function on our website and use the social media plug-in. According to Facebook, the following user data is then transmitted to Facebook and stored there:
Facebook sees the date and time of your visit, the website you are on (URL), and other technical information about the IP address, browser, and operating system you are using. This is data that Facebook can use to optimize your experience, depending on the browser you use and whether you are logged into Facebook with your personal user data or not.
If you are logged into Facebook with your personal user data at the same time as visiting our websites, your user ID number will also be transmitted to Facebook by visiting our websites and activating the social media plug-in, whereby the transmitted data can be assigned to your user account. According to Facebook’s own statements, this is necessary to show you the correct social context or social environment on Facebook’s websites.
By using the Facebook plug-ins, e.g., by clicking the “Like” button, the Facebook plug-in establishes a direct connection between your browser and the Facebook servers. In this process, additional information is then sent to Facebook, stored there, and published in your personal Facebook profile, in particular that you have accessed our website on which the Facebook plug-in was used and that you liked this website or recommend visiting it.
If you do not wish for the aforementioned data transfers to Facebook, we recommend that you do not activate the Facebook plug-ins on our website and/or log out of Facebook before visiting our websites.
Information on the type, scope, and purpose of the collection and use of personal data by Facebook, as well as your related rights and setting options for protecting your privacy, can be found in Facebook’s privacy policy at http://de-de.facebook.com/policy.php.
The use of Facebook plug-ins described above takes place from May 25, 2018, based on our legitimate business advertising interests and thus on the legal basis of Article 6(1)(f) GDPR.
Google+1 Plugins
We use the “+1 button” of Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter referred to as “Google”) on our websites. The button is marked with the “+1” logo. With the help of the +1 button, you can publish information worldwide, provided you have a Google profile.
If you visit one of our websites where a +1 button is used and activate it via our activation function on our website without then clicking the +1 button, Google logs your browser history for approximately two weeks and evaluates your visit to this website exclusively for system maintenance and troubleshooting purposes. In this case, the +1 button is not used to record your visits to the web or to evaluate your visit to the website in any other way. This data is also not structured according to individual profiles, usernames, or URLs.
If you are logged in to Google and click the +1 button via our activation function, Google stores both the information that you have given +1 to content and information about the page you viewed when clicking +1. Specifically, information about your Google profile, the URL you recommended, your IP address, and other browser-related information are stored. In addition, information about your +1 activities is stored by Google to improve Google services for you and others.
It should be noted that giving a +1 is a public process. Anyone who performs a Google search or accesses content on the web that you +1 can potentially see that you have given that content a +1. Your +1 recommendations can, for example, be displayed as hints along with your profile name and photo in Google services, such as in search results or in your Google profile or in other places on websites and advertisements on the Internet. For the reasons mentioned above, you should therefore only give +1 recommendations for pages if you are sure that you want to share this recommendation with the whole world. Further information from Google on “+1 hints on the web” can be found at:
Through the Google +1 button, you and other users also receive personalized content from Google and Google’s partner companies. Further information from Google on “+1 personalization on third-party websites” can be found here:
If you do not wish for the aforementioned data transfers to Google, we recommend that you do not activate the Google+1 plugin and log out of Google before visiting our websites and/or disable the use of JavaScript in your browser. Information on configuring your browser settings can be found in the help function of your respective internet browser.
General information on Google’s handling of data protection when using the +1 button, as well as your profile setting options for protecting your privacy, can be found in the “Google +1 Button – Privacy Policy”:
https://www.google.com/intl/de/+/policy/+1button.html
as well as Google’s information on “Data protection when using the +1 button” at:
The use of Google+1 plugins described above takes place from May 25, 2018, based on our legitimate business advertising interests and thus on the legal basis of Article 6(1)(f) GDPR.
Notes on Tripadvisor Plugins
This website uses the plugin of TripAdvisor LLC, 400 1st Avenue, Needham, MA 02494, USA, an online travel industry company that offers user reviews and opinions on tourist offerings and combines them with booking recommendations. You recognize these plug-ins by the Tripadvisor logos (a stylized owl). We use Tripadvisor’s plugins to neutrally display customer reviews about us.
When you visit one of our web pages on which a Tripadvisor plug-in is used, a direct connection between your browser and Tripadvisor is established. According to Tripadvisor, your IP address and information about which of our pages you have visited are then transmitted, and Tripadvisor cookies are set on your device for tracking purposes. Information on the type, scope, and purpose of the collection and use of personal data by Tripadvisor, as well as your related rights and setting options for protecting your privacy, can be found in Tripadvisor’s privacy policy:
https://www.tripadvisor.de/pages/privacy.html.
If you do not wish for the aforementioned data transfers to Tripadvisor, we recommend that you disable JavaScript in your browser and deactivate the storage of cookies and delete existing cookies from your browser before visiting our websites. Information on configuring your browser settings can be found in the help function of your respective internet browser.
The use of the Tripadvisor plugin described above takes place from May 25, 2018, based on our legitimate business advertising interests and thus on the legal basis of Article 6(1)(f) GDPR.
16. Newsletter
We use the MailChimp service from “The Rocket Science Group, LLC, 512 Means Street, Suite 404, Atlanta, GA 30318 (hereinafter referred to as “Rocket”) for sending our newsletter. Rocket is certified according to the EU-US Privacy Shield Agreement and thus commits to complying with EU data protection regulations.
Below, we inform you about the ordering and sending process of our newsletter, the cancellation of the newsletter, as well as the respective data processing processes and the legal basis for the use of our newsletter service:
a) Ordering and Sending Our Newsletter
If you order our newsletter, you must enter the personal data visible in the ordering process. Your provided data will be transmitted to Rocket’s servers in the USA and stored there by Rocket. The data you must provide during registration will not be transmitted to other third parties. During the initial registration, Rocket sends a confirmation email using the double opt-in procedure to the email address provided during registration for legal reasons, to receive confirmation from the recipient that they are the owner of the registered email address or have authorized the order of our newsletter to their email address.
Rocket uses your data for sending and evaluating our newsletter on our behalf, whereby these analyses are only group-related and not used for individual evaluation. Rocket also uses your data for analysis and technical optimization of the newsletter service and may integrate the Google Analytics analysis tool and Google Tag Manager from Google LLC into the newsletters. Details on Google Analytics can be found in the aforementioned information on this service.
You can view MailChimp’s privacy policy at the following link:
https://mailchimp.com/legal/privacy/
b) Cancellation of the newsletter:
You can cancel the newsletter at any time by using the unsubscribe function, which we inform you about in every newsletter. By canceling the newsletter service, the consent given to us for sending the newsletter is also revoked with effect for the future. The lawfulness of the data processing carried out based on the consent until withdrawal is not affected by the withdrawal.
After cancellation of the newsletter service and withdrawal of consent, your personal data will be routinely deleted once the purpose ceases.
If individual data must be retained due to legal retention periods (e.g., tax and commercial law retention regulations), the data will be blocked instead of deleted. The data to be retained may then be processed exclusively for the aforementioned purposes on the legal basis of Article 6(1)(c) GDPR.
c) Legal Basis for the Use of Our Newsletter:
The use of our newsletter described above takes place from May 25, 2018, on the legal basis of your consent and thus on Art. 6(1)(a) GDPR. Furthermore, there is also a legitimate interest within the meaning of Art. 6(1)(f) GDPR for the use of the Mailchimp newsletter service. Our legitimate interest lies in offering you a user-friendly and secure newsletter system that serves both our business interests and meets user expectations.
Status of the Privacy Policy: 2026-01-21