Privacy policy

In this Privacy Policy, we describe what we do with your data when you use www.rosas-cantares.de, other websites of ours or our apps (hereinafter collectively “Website”), purchase our services or products, are otherwise in contact with us under a contract, communicate with us or otherwise deal with us. Where appropriate, we will provide you with timely written notice of additional processing activities not mentioned in this Privacy Policy. In addition, we may inform you separately about the processing of your data, e.g. in declarations of consent, contractual terms, additional data protection declarations, forms and notices.

If you transmit or disclose data about other persons, such as family members, work colleagues, etc., we assume that you are authorized to do so and that this data is correct. By transmitting data about third parties, you confirm this. Please also ensure that these third parties have been informed about this data protection declaration.

Cortijo Rosas Cantares, 29560 Málaga Spain, is responsible under data protection law for the data processing described in this privacy policy, unless otherwise communicated in individual cases.

You can contact us as follows for your data protection concerns and to exercise your rights in accordance with section 11:

Cortijo Rosas Cantares
A-357 / Km 37 Pizarra
29560 Málaga Spain

+34 691 741 010
moc.seratnac-sasorobfsctd-7c183c@snoitavreser

We process various categories of data about you. The main categories are as follows:

• Technical data: When you use our website or other electronic offers (e.g. free WLAN), we collect the IP address of your end device and other technical data to ensure the functionality and security of these offers. This data also includes logs in which the use of our systems is recorded. We generally store technical data for 12 months. In order to ensure the functionality of these offers, we can also assign you or your end device an individual code (e.g. in the form of a cookie, see section 12). The technical data itself does not allow any conclusions to be drawn about your identity. However, in the context of user accounts, registrations, access controls or the processing of contracts, they can be linked to other data categories (and thus possibly to your person).

  The technical data includes, among other things, the IP address and information about the operating system of your end device, the date, region and time of use as well as the type of browser you use to access our electronic offers. This can help us to transmit the correct formatting of the website or, for example, to show you a website adapted to your region. Although we know from the IP address which provider you are using to access our offers (and therefore also the region), we cannot usually deduce who you are from this. This changes if you create a user account, for example, because personal data can then be linked to technical data (e.g. we can see which browser you use to access an account via our website). Examples of technical data include logs that are generated in our systems (e.g. the log of user logins on our website).

• Registration data: Certain offers, e.g. of competitions and services (e.g. login areas of our website, newsletter dispatch, free WLAN access, etc.) can only be used with a user account or registration, which can be done directly with us or via our external login service providers. In doing so, you must provide us with certain data and we collect data on the use of the offer or service. We generally retain registration data for 12 months after the end of the use of the service or the termination of the user account.

  Registration data includes the information you provide when you create an account on our website (e.g. user name, password, name, e-mail address). However, registration data also includes the data that we may require from you before you can make use of certain free services, such as our WLAN service, in this case: name, e-mail and telephone number; or the redemption of vouchers, in this case: name, address, contact details, time of redemption. You must also register if you wish to subscribe to our newsletter.

• Communication data: If you contact us via the contact form, by e-mail, telephone or chat, by letter or by other means of communication, we record the data exchanged between you and us, including your contact details and the marginal data of the communication. If we record or listen in on telephone conversations or video conferences, e.g. for training and quality assurance purposes, we will make you aware of this. Such recordings may only be made and used in accordance with our internal guidelines. You will be informed if and when such recordings take place, e.g. by a display during the relevant video conference. If you do not wish to be recorded, please let us know or end your participation. If you simply do not wish your image to be recorded, please switch off your camera. If we want or need to establish your identity, e.g. if you request information, apply for media access, etc., we will collect data to identify you (e.g. a copy of your ID). As a rule, we store this data for 12 months from the last exchange with you. This period may be longer if this is necessary for reasons of proof or to comply with legal or contractual requirements or for technical reasons. E-mails in personal mailboxes and written correspondence are generally stored for at least 10 years.

  Communication data includes your name and contact details, the manner, place and time of communication and, as a rule, its content (i.e. the content of e-mails, letters, chats, etc.). This data may also contain information about third parties. For the purpose of identification, we may also process your ID number or a password set by you.

• Master data: We define master data as the basic data that we require in addition to the contract data (see below) for the processing of our contractual and other business relationships or for marketing and advertising purposes, such as name, contact details and information, e.g. about your role and function, your bank account(s), your date of birth, customer history, powers of attorney, signature authorizations and declarations of consent. We process your master data if you are a customer or other business contact or work for one (e.g. as a contact person of the business partner), or because we want to contact you for our own purposes or the purposes of a contractual partner (e.g. as part of marketing and advertising, with invitations to events, with vouchers, with newsletters, etc.). We receive master data from you (e.g. when you make a purchase or register), from bodies for which you work or from third parties such as our contractual partners, associations and address dealers and from publicly accessible sources such as public registers or the internet (websites, social media, etc.). We may also process health data and information about third parties as part of master data. We may also collect master data from our shareholders and investors. We generally store this data for 10 years from the last exchange with you, but at least from the end of the contract. This period may be longer if this is necessary for reasons of proof or to comply with legal or contractual requirements or for technical reasons. In the case of pure marketing and advertising contacts, the period is normally much shorter, usually no more than 2 years from the last contact.

  The master data includes, for example, data such as name, address, e-mail address, telephone number and other contact details, gender, date of birth, nationality, details of associated persons, websites, social media profiles, photos and videos, copies of ID cards; furthermore, details of your relationship with us (customer, supplier, visitor, service recipient, etc.), details of your status with us, classifications and distribution lists, details of our interactions with you (if applicable, a history of these with corresponding entries), reports (e.g. from the media), information about your relationship with us (e.g. from the media), information about your personal data.We also collect information about your relationship with us (customer, supplier, visitor, service recipient, etc.), information about your status with us, assignments, classifications and distribution lists, information about our interactions with you (possibly a history of these with corresponding entries), reports (e.g. from the media) or official documents (e.g. extracts from the commercial register, authorizations, etc.) that relate to you. We collect payment details such as your bank details, account number and credit card details. Consent or blocking notices are also part of the master data, as is information about third parties, e.g. contact persons, recipients of services, advertising recipients or representatives.

  For contact persons and representatives of our customers, suppliers and partners, we process master data such as name and address, information on role, function in the company, qualifications and, if applicable, information on superiors, employees and subordinates and information on interactions with these persons.

  Master data is not collected comprehensively for all contacts. Which data we collect in detail depends in particular on the purpose of the processing.

• Contract data: This is data that arises in connection with the conclusion or execution of a contract, e.g. information about contracts and the services to be provided or provided, as well as data from the run-up to the conclusion of a contract, the information required or used for processing and information about reactions (e.g. complaints or information about satisfaction, etc.). This also includes health data and information about third parties, e.g. about hereditary diseases in the family. We generally collect this data from you, from contractual partners and from third parties involved in the execution of the contract, but also from third-party sources (e.g. providers of credit rating data) and from publicly accessible sources. As a rule, we store this data for 10 years from the last contractual activity, but at least from the end of the contract. This period may be longer if this is necessary for reasons of proof or to comply with legal or contractual requirements or for technical reasons.

  Contract data includes information about the conclusion of the contract, about your contracts, e.g. type and date of conclusion of the contract, information from the application process (such as an application for our products or services) and information about the contract in question (e.g. its duration) and the processing and administration of the contracts (e.g. information in connection with invoicing, customer service, support with technical matters and the enforcement of contractual claims). Contract data also includes information on defects, complaints and adjustments to a contract, as well as information on customer satisfaction, which we can collect e.g. by means of surveys. Contract data also includes financial data such as information on creditworthiness (i.e. information that allows conclusions to be drawn about the likelihood of claims being settled), reminders and debt collection. We receive some of this data from you (e.g. when you make payments), but also from credit agencies and debt collection agencies and from publicly accessible sources (e.g. a commercial register).

We only provide you with certain services if you provide us with registration data because we or our contractual partners want to know who is using our services or has accepted an invitation to an event, because it is technically necessary or because we want to communicate with you. If you or a person you represent (e.g. your employer) wishes to conclude or fulfill a contract with us, we must collect corresponding master data, contract data and communication data from you, and we process technical data if you wish to use our website or other electronic offers for this purpose. If you do not provide us with the data required for the conclusion and execution of the contract, you must expect that we will refuse to conclude the contract, that you will commit a breach of contract or that we will not fulfill the contract. Similarly, we will only be able to send you a response to an inquiry from you if we process the relevant communication data and – if you communicate with us online – possibly also technical data. It is also not possible to use our website without providing us with technical data.

We process your data for the purposes explained below. Further information for the online area can be found in sections 12 and 13. These purposes and the underlying objectives represent legitimate interests of us and, where applicable, of third parties. You will find further information on the legal basis of our processing in Section 5.

We process your data for purposes related to communication with you, in particular to respond to inquiries and assert your rights (Section 11) and to contact you in the event of queries. In particular, we use communication data and master data and, in connection with offers and services used by you, registration data. We retain this data in order to document our communication with you, for training purposes, for quality assurance and for follow-up questions.

This relates to all purposes in connection with which you and we communicate, whether in customer service or consulting, authentication in the event of use of the website or for training and quality assurance (e.g. in the area of customer service). We further process communication data so that we can communicate with you by e-mail and telephone, as well as messenger services, chat, social media, letter and fax. Communication with you usually takes place in connection with other processing purposes, e.g. so that we can provide services or respond to a request for information. Our data processing also serves as proof of communication and its content. We process
data for the establishment, administration and processing of contractual relationships.

We conclude contracts of various kinds with our business and private customers, with suppliers, subcontractors or other contractual partners, such as partners in projects or with parties in legal disputes. In particular, we process master data, contract data and communication data and, depending on the circumstances, registration data of the customer or the persons to whom the customer provides a service.

As part of the business initiation process, personal data – in particular master data, contract data and communication data – is collected from potential customers or other contractual partners (e.g. in an order form or contract) or results from communication. We also process data in connection with the conclusion of the contract to check creditworthiness and to open the customer relationship. In some cases, this information is checked for compliance with legal requirements.

As part of the processing of contractual relationships, we process data for the administration of the customer relationship, for the provision and collection of contractual services (which also includes the involvement of third parties, for advice and for customer support. The enforcement of legal claims arising from contracts (debt collection, legal proceedings, etc.) is also part of processing, as are accounting, termination of contracts and public communication.

We process data for marketing purposes and to maintain relationships, e.g. to send our customers services from us. This may take the form of newsletters and other regular contacts (electronically, by post, by telephone), via other channels for which we have contact information from you, but also as part of individual marketing campaigns (e.g. events, competitions, etc.) and may also include free services (e.g. invitations, vouchers, etc.). You can reject such contacts at any time (see the end of this section 4) or refuse or revoke your consent to being contacted for advertising purposes.

For example, with your consent, we will send you information and product offers from us in printed form, electronically or by telephone. For this purpose, we mainly process communication and registration data. Like most companies, we personalize communications so that we can provide you with individual information and offers that meet your needs and interests. To do this, we combine data that we process about you and determine preference data and use this data as the basis for personalization (see section 3).

Relationship management also includes addressing existing customers and their contacts on a personalized basis, if necessary based on behavioral and preference data. As part of relationship management, we may also operate a customer relationship management system (“CRM”), in which we store the data on customers, suppliers and other business partners necessary for the relationship management, e.g. about contact persons, relationship history (e.g. about products and services purchased or supplied, interactions, etc.), interests, wishes, marketing measures (newsletters, invitations to events, etc.) and other information.

All of this processing is important for us not only to promote our offers as effectively as possible, but also to make our relationships with customers more personal and positive, to focus on the most important relationships and to use our resources as efficiently as possible.

We continue to process your data for market research, to improve our services and operations and for product development.

We strive to continuously improve our products and services (including our website) and to be able to react quickly to changing needs. We therefore analyze, for example, how you navigate through our website or which products are used by which groups of people and in what way, and how new products and services can be designed (for further details, see section 12). This gives us an indication of the market acceptance of existing products and services and the market potential of new products and services. In particular, we process master data, behavioral data and preference data, but also communication data and information from customer surveys, polls and studies and other information, e.g. from the media, social media, the Internet and other public sources. Where possible, we use pseudonymized or anonymized data for these purposes. We may also use media monitoring services or carry out media monitoring ourselves and process personal data in order to carry out media work or to understand and react to current developments and trends.

With your consent, we use non-anonymized location data to inform you of interesting offers and products in the vicinity based on your position, to infer your interests from the location data (dwell time) and to inform you which products and services other contractual partners with similar interests have used.

We may also process your data for security purposes and for access control.

We continuously review and improve the appropriate security of our IT and other infrastructure (e.g. buildings). Like all companies, we cannot rule out data security breaches with absolute certainty, but we do what we can to reduce the risks. We therefore process data, for example, for monitoring, checking, analyzing and testing our networks and IT infrastructures, for system and error checks, for documentation purposes and as part of backup copies. Access controls include controlling access to electronic systems (e.g. logging in to user accounts) as well as physical access control (e.g. building access).

We process personal data to comply with laws, instructions and recommendations from authorities and internal regulations (“compliance”).

This includes, for example, the implementation of health and safety concepts or the legally regulated fight against money laundering and the financing of terrorism. In certain cases, we may be obliged to make certain inquiries about customers (“Know Your Customer”) or to submit reports to authorities. The fulfillment of disclosure, information or reporting obligations, e.g. in connection with supervisory and tax obligations, also requires or entails data processing, e.g. the fulfillment of archiving obligations and the prevention, detection and clarification of criminal offenses and other violations. This also includes the receipt and processing of complaints and other reports, the monitoring of communications, internal investigations or the disclosure of documents to an authority if we have sufficient reason to do so or are legally obliged to do so. Your personal data may also be processed in the event of external investigations, e.g. by a law enforcement or supervisory authority or a commissioned private body. For all these purposes, we process in particular your master data, your contract data and communication data, but possibly also behavioral data and data from the category of other data. The legal obligations may relate to Swiss law, but also to foreign regulations to which we are subject, as well as self-regulation, industry standards, our own corporate governance and official instructions and requests.

We also process data for the purposes of our risk management and in the context of prudent corporate governance, including business organization and corporate development.

For these purposes, we process master data, contract data, registration data and technical data in particular, but also behavioral and communication data. For example, we need to monitor our debtors and creditors as part of our financial management, and we need to avoid becoming victims of crime and abuse, which may require the evaluation of data for corresponding patterns. We may also carry out profiling and create and process profiles for these purposes and to protect you and us from criminal or abusive activities (see also section 6). As part of the planning of our resources and organization of our operations, we must evaluate and process data on the use of our services and other offers or exchange information with others (e.g. outsourcing partners), which may also include your data. The same applies to services provided to us by third parties. As part of our corporate development, we may sell or acquire businesses, parts of businesses or companies to or from others or enter into partnerships, which may also lead to the exchange and processing of data (including from you, e.g. as a customer or supplier or as a supplier representative).

We may process your data for other purposes, e.g. as part of our internal processes and administration.

If we ask for your consent for certain processing, we will inform you separately about the corresponding purposes of the processing. You can withdraw your consent at any time with effect for the future by sending us written notification (by post) or, unless otherwise stated or agreed, by email; our contact details can be found in Section 2. For the withdrawal of your consent to online tracking, see Section 12. If you have a user account, you can also withdraw your consent or contact us via the relevant website or other service. Once we have received notification of the withdrawal of your consent, we will no longer process your data for the purposes to which you originally consented, unless we have another legal basis for doing so. The withdrawal of your consent shall not affect the lawfulness of processing based on consent before its withdrawal.
Where we do not ask for your consent for processing, we base the processing of your personal data on the fact that the processing is necessary for the initiation or execution of a contract with you (or the entity you represent) or that we or third parties have a legitimate interest in it, in particular to pursue the purposes and associated objectives described above under Section 4 and to be able to carry out corresponding measures. Our legitimate interests also include compliance with statutory provisions, insofar as this is not already recognized as a legal basis by the applicable data protection law (e.g. in the case of the GDPR, the law in the EEA and Switzerland).

In connection with our contracts, the website, our services and products, our legal obligations or otherwise to safeguard our legitimate interests and the other purposes listed in Section 4, we also transfer your personal data to third parties, in particular to the following categories of recipients:

• Service providers: We work with service providers in Germany and abroad who process data about you on our behalf or under joint responsibility with us or who receive data about you from us under their own responsibility. (e.g. IT providers, shipping companies, advertising service providers, login service providers, cleaning companies, security companies, banks, insurance companies, debt collection companies, credit agencies or address verifiers). This may also include health data.
• Contractual partners including customers: This initially refers to customers (e.g. service recipients) and other contractual partners of ours, because this data transfer arises from these contracts. If you work for such a contractual partner yourself, we may also transfer data about you to them in this context. This may also include health data. The recipients also include contractual partners with whom we cooperate.
• Public authorities: We may disclose personal data to offices, courts and other authorities in Switzerland and abroad if we are legally obliged or entitled to do so or if this appears necessary to protect our interests. This may also include health data. The authorities process data about you that they receive from us under their own responsibility.
• Other persons: This refers to other cases where the inclusion of third parties arises from the purposes set out in section 4, e.g. service recipients, media and associations in which we participate or if you are part of one of our publications.

All these categories of recipients may in turn involve third parties, so that your data may also become accessible to them. We can restrict the processing by certain third parties (e.g. IT providers), but not by other third parties (e.g. authorities, banks, etc.).

We reserve the right to disclose this data even if it concerns confidential data (unless we have expressly agreed with you that we will not disclose this data to certain third parties, unless we are legally obliged to do so). Irrespective of this, your data will continue to be subject to appropriate data protection even after disclosure in Switzerland and the rest of Europe. The provisions of Section 8 apply to disclosure to other countries. If you do not wish certain data to be disclosed, please let us know so that we can check whether and to what extent we can accommodate you (Section 2).

We also allow certain third parties to collect personal data from you on our website and at our events (e.g. media photographers, providers of tools that we have integrated on our website, etc.). Insofar as we are not decisively involved in this data collection, these third parties are solely responsible for it. If you have any concerns and wish to assert your data protection rights, please contact these third parties directly. See section 12 for the website.

We process your data for as long as required by our processing purposes, the statutory retention periods and our legitimate interests in processing for documentation and evidence purposes or if storage is technically necessary. Further information on the respective storage and processing periods can be found in the individual data categories in section 3 or in the cookie categories in section 12. If there are no legal or contractual obligations to the contrary, we will delete or anonymize your data after the storage or processing period has expired as part of our normal processes.

Documentation and evidence purposes include our interest in documenting processes, interactions and other facts in the event of legal claims, discrepancies, IT and infrastructure security purposes and proof of good corporate governance and compliance. Retention may be required for technical reasons if certain data cannot be separated from other data and we therefore need to retain it with the other data (e.g. in the case of backups or document management systems).

We take appropriate security measures to protect the confidentiality, integrity and availability of your personal data, to protect it against unauthorized or unlawful processing and to counteract the risks of loss, unintentional alteration, unwanted disclosure or unauthorized access.

Security measures of a technical and organizational nature may include, for example, measures such as the encryption and pseudonymization of data, logging, access restrictions, the storage of backup copies, instructions to our employees, confidentiality agreements and controls. We protect your data transmitted via our website in transit using suitable encryption mechanisms. However, we can only secure areas that we control. We also oblige our contract processors to take appropriate security measures. However, it is generally not possible to completely rule out security risks; residual risks are unavoidable.

• The right to request information from us as to whether and which of your data we process;
• the right to have us correct data if it is incorrect;
• the right to request the deletion of data;
• the right to obtain from us the personal data concerning you in a commonly used electronic format or to transmit those data to another controller;
• the right to withdraw consent where our processing is based on your consent;
• the right to receive, on request, further information necessary for the exercise of these rights;

• Necessary cookies: Some cookies are necessary for the functioning of the website as such or for certain functions. For example, they ensure that you can switch between pages without losing any information entered in a form. They also ensure that you remain logged in. These cookies are only temporary (“session cookies”). If you block them, the website may not work. Other cookies are necessary so that the server can save decisions or entries made by you beyond a session (i.e. a visit to the website) if you use this function (e.g. selected language, consent given, the function for automatic log-in, etc.). These cookies have an expiry date of up to 24 months.
• Performance cookies: In order to optimize our website and corresponding offers and to better tailor them to the needs of users, we use cookies to record and analyze the use of our website, possibly even beyond the session. We do this by using third-party analysis services. We have listed these below. Performance cookies also have an expiry date of up to 24 months. Details can be found on the websites of the third-party providers.

• Page views
• First visit to the website
• Start of the session
• Your “click path”, interaction with the website
• Scrolls (whenever a user scrolls to the end of the page (90%))
• Clicks on external links
• internal search queries
• Interaction with videos
• File downloads
• Viewed / clicked ads
• Language setting

• Your approximate location (region)
• Your IP address (in abbreviated form)
• technical information about your browser and the end devices you use (e.g. language setting, screen resolution)
• Your Internet provider
• the referrer URL (via which website/advertising medium you came to this website)

• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (as processor pursuant to Art. 28 GDPR)
• Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
• Alphabet Inc., 1600 Amphitheatre Parkway Mountain View, CA 94043, USA

1. do not give your consent to the setting of the cookie or
   b. download and install the browser add-on to deactivate Google Analytics HERE.

We may operate pages and other online presences (“fan pages”, “channels”, “profiles”, etc.) on social networks and other platforms operated by third parties and collect the data about you described in Section 3 and below. We receive this data from you and the platforms when you come into contact with us via our online presence (e.g. when you communicate with us, comment on our content or visit our presence). At the same time, the platforms evaluate your use of our online presence and link this data with other data about you known to the platforms (e.g. about your behavior and preferences). They also process this data for their own purposes under their own responsibility, in particular for marketing and market research purposes (e.g. to personalize advertising) and to control their platforms (e.g. what content they show you).

We receive data about you when you communicate with us via online presences or view our content on the relevant platforms, visit our online presences or are active on them (e.g. publish content, make comments). These platforms also collect technical data, registration data, communication data, behavioral data and preference data from you or about you (for the terms, see section 3). These platforms regularly statistically evaluate the way in which you interact with us, how you use our online presences, our content or other parts of the platform (what you view, comment on, “like”, share, etc.) and link this data with other information about you (e.g. information on age and gender and other demographic information). In this way, they also create profiles about you and statistics on the use of our online presences. They use this data and profiles to show you our or other advertising and other content on the platform in a personalized way and to control the behavior of the platform, but also for market and user research and to provide us and other parties with information about you and the use of our online presence. We can partially control the evaluations that these platforms create regarding the use of our online presence.

We process this data for the purposes described in section 4, in particular for communication, for marketing purposes (including advertising on these platforms, see section 12) and for market research. You will find information on the relevant legal bases in section 5. We may redistribute content published by you (e.g. comments on an announcement) ourselves (e.g. in our advertising on the platform or elsewhere). We or the operators of the platforms may also delete or restrict content from or about you in accordance with the usage guidelines (e.g. inappropriate comments).

For further information on the processing carried out by the platform operators, please refer to the platforms’ data protection notices. There you can also find out in which countries they process your data, what rights of access, erasure and other rights of data subjects you have and how you can exercise these or obtain further information.

This privacy policy is not part of any contract with you. We may amend this privacy policy at any time. The version published on this website is the current version.