DATA PROTECTION POLICY
1. Name and address of the data controller
The in accordance with law and policy the person responsible for your data privacy is:
South African Tourism
Peace Road 6 - 10
Represented by Hub Head Central Europe:
Theresa Bay Muller
Telephone: 069/92 91 29 0
Fax: 069/92 91 29 50
1.1 Contact details of the data protection officer
The data protection officer of the responsible person is:
South African Tourism
Peace Road 6 - 10
Represented by Hub Head Central Europe:
Theresa Bay Muller
Telephone: 069/92 91 29 0
Fax: 069/92 91 29 50
2. General Information on Our Data Collection
Our website collects generic data and information each time a Web page is accessed by an affected person or an automated system. This general data and information is stored in the log files of the web server. The browser types and versions used, the operating system used by the accessing system, the website from which an accessing system accesses our website (so-called referrers), the sub-web pages accessed via an accessing system on our website, the date and time can be recorded the time of access to the website, an Internet Protocol (IP) address, the accessing Internet service provider and other similar data and information;
When using this general data and information no conclusions are drawn on the data subject. Rather, this information is needed to properly deliver the contents of our website, to optimize the content of the website as well as to advertise it, to ensure the continued functioning of our information technology systems and the technology of our website, and to prosecute the law enforcement agencies in case of a cyberattack in order to provide information. The collected data and information is anonymous and is therefore statistically and further processed with the aim of increasing data protection and data security in the company in order to ultimately ensure an optimal level of protection for the personal data processed.
2.1 Scope of the processing of personal data
In principle, we collect and use personal data of our users only to the extent necessary to provide a functional website and our content and services.
You could also be requested to provide us with personal data in the following circumstances:
- When you contact us via the our contact form or by e-mail and provide us with such personal data in order to enable us to attend to your query or correspondence;
- When you order our newsletter;
- When you register as a supplier;
- When you register as a guest for hosting;
- When you decide to participate in a competition or raffle.
It is up to you to decide whether you provide us with the required personal data in order to meaningfully participate or otherwise contract with us.
If you provide us with personal data, such personal data will be treated confidentially and used only for the purpose for which you have provided us.
The collection and use of personal data of our users, clients and suppliers takes place regularly only with the consent of the user, client or supplier. An exception applies to cases in which prior consent cannot be obtained for reasons of fact and the processing of the data is permitted by law.
2.2 Legal basis for the processing of personal data
The legal basis for processing personal data is your declaration of consent, whether express or implied, when making use of our website or participating in any of the activities above that requires your personal data and is regulated under the provisions of Article 6 (1)(a) of the EU General Data Protection Regulation (EUGDPR).
Contracts and pre-contractual negotiations and actions may require that we obtain your personal data in order to ensure the performance of the contract and would as such provide the legal basis for the processing of personal data in accordance with the provisions of Article 6(1)(b) of the EUGDPR.
Whenever the legitimate interests of our Organization or a third party requires protection and such legitimate interest is not subject to your interests, fundamental rights and freedoms, Article 6(1)(f) of the EUGDPR would provide the legal basis for the processing of your personal data.
2.3 Data deletion and storage duration
The personal data of the data subject will be deleted or blocked as soon as the purpose of the storage thereof ceases. Additional data storage may be required if provided for by the European or national legislator in EU regulations, laws or other regulations to which the data controller is subject. Blocking or deletion of the personal data will also occur when the storage period prescribed by standard or law dictates such deletion or blocking of personal data, unless there is a need for additional periods of storage of the personal data for conclusion of a contract or fulfillment of a contract.
3. Provision of the website and creation of logfiles
3.1 Description and scope of data processing
Each time our website is accessed, our system automatically collects data and information from the computer system of the calling computer.
The following data is collected here:
- Information about the browser type and version used
- The operating system of the user
- The Internet service provider of the user
- The IP address of the user
- Date and time of access
- Websites from which the user's system accesses our website
- Websites accessed by the user's system through our website
The log files contain IP addresses or other data that allow an assignment to a user. This could be the case, for example, if the link to the website from which the user accesses the website or the link to the website to which the user is switching contains personal data.
The data is also stored in the log files of our system. A storage of this data together with other personal data of the user does not take place.
3.2 Legal basis for data processing
The legal basis for the temporary storage of data and log files is Art. 6 para. 1 lit. f EUGDPR
3.3 Purpose of the data processing
The temporary storage of the IP address by the system is necessary to allow delivery of the website to the computer of the user. To do this, the user's IP address must be kept for the duration of the session.
Storage in log files is done to ensure the functionality of the website. In addition, the data is used to optimize the website and to ensure the security of our information technology systems. An evaluation of the data for marketing purposes does not take place in this context.
For these purposes, our legitimate interest in the processing of data according to Art. 6 para. 1 lit. f EUGDPR
3.4 Duration of storage
The data will be deleted as soon as it is no longer necessary for the purpose of its collection. In the case of collecting the data for providing the website, this is the case when the respective session is completed.
In the case of storing the data in log files, this is the case after no more than seven days. An additional storage is possible. In this case, the IP addresses of the users are deleted or alienated, so that an assignment of the calling client is no longer possible.
3.5 Opposition and removal options
The collection of data for the provision of the website and the storage of the data in log files is essential for the operation of the website. There is consequently no infringement of the data subject rights of the user.
The data subject can prevent the setting of cookies and thus also the tracking with pixel tags via the cookies through our website at any time by means of a corresponding settings of the Internet browser used and thus permanently contradict the setting of cookies. Furthermore, already set cookies can be deleted at any time via an internet browser or other software programs. This is possible in all common internet browsers. If the data subject deactivates the setting of cookies in the Internet browser used, not all functions of our website may be fully usable.
4.1 Description and scope of data processing
In this way, for example, the following data can be transmitted:
- Entered search terms
- Frequency and duration of page views
- Use of website functions
- Name and version of the operating system and device usage
- Name, version and language setting of the browser
4.2 Legal basis for data processing
The legal basis for the processing of personal data using technically necessary cookies is Article 6 (1) lit. f EUGDPR
The legal basis for the processing of personal data using cookies for analysis purposes is the consent of the user Art. 6 para. 1 lit. a EUGDPR
4.3 Purpose of the data processing
We require cookies for the following applications:
- Taking over the information of the cookie hint banner
The user data collected through these sort of cookies will not be used to create user profiles.
The use of the analysis cookies and tracking pixels is for the purpose of improving the quality of our website and its contents. Through the analysis cookies and tracking pixels, we learn how the website is used and so we can constantly optimize our offer.
We require cookies for the following applications:
- Anonymized analysis software of visitor behavior on the site. This allows us to customize content of the site based on interests in order to always optimize the experience on the website and to remain relevant to users.
For these purposes, our legitimate interest in the processing of personal data pursuant to Art. 6 para. 1 lit. f EUGDPR
4.4 Duration of Storage, Opposition and Removal Options
5.1 Description and scope of data processing
A newsletter will be sent by subscribing to the newsletter on the website or by registering as part of a South African Tourism marketing campaign.
On our website it is possible to subscribe to a free newsletter. The data from the input mask are transmitted to us when registering for the newsletter.
The application concerns the following information:
- First given name
- E-mail address
In addition, the following data is collected upon registration:
- IP address of the calling computer
- Date and time of registration
The purpose of the newsletter is to inform you about, for example, competitions and travel offers and to provide you with further information on travel destination South Africa.
In connection with the processing of data for the sending of newsletters, there is no disclosure of the data to third parties. The data will be used exclusively for sending the newsletter.
5.2 Legal basis for data processing
The newsletter is sent on the basis of registration of the user on the website or participation in a marketing campaign by South African Tourism, in which the user has expressed his interest in receiving the newsletter.
The legal basis for the processing of the data after the user has registered for the newsletter is the consent of the user Art. 6 para. 1 lit. a EUGDPR
5.3 Purpose of the data processing
The collection of the user's e-mail address serves to deliver the newsletter.
The collection of other personal data in the context of the registration process serves to prevent misuse of the services or the email address used.
5.4 Duration of storage
The data will be deleted as soon as it is no longer necessary for the purpose of its collection. The e-mail address of the user is therefore stored as long as the subscription to the newsletter is active.
The other personal data collected during the registration process will normally be deleted after a period of seven days.
5.5 Opposition and deletion possibilities
Subscription to the newsletter may be terminated at any time by the user concerned. For this purpose, there is a corresponding link in each newsletter.
This also allows a revocation of the consent to the storage of the personal data collected during the registration process.
6. Contact form and e-mail contact
6.1 Description and scope of data processing
Our website includes and electronic contact form, which can be used for electronic contact. Users utilizing this optionof communication, are herewith notified that the data entered into the input mask will be transmitted to us and saved.
This data include:
- You're interested in
- First given name
- E-mail address
- your text
At the time of sending the message, the following data is also stored:
- The IP address of the user
- Date and time of registration
For the processing of the data in the context of the sending process your consent is obtained and referred to this privacy statement. (See Declaration of Consent)
Alternatively, contact via the provided e-mail address is possible. In this case, the user's personal data transmitted by e-mail will be stored.
In this context, it does not pass on the data to third parties. The data is used exclusively for processing the conversation.
6.2 Legal basis for data processing
Legal basis for the processing of the data is in the presence of the consent of the user Art. 6 para. 1 lit. a EUGDPR.
The legal basis for the processing of the data transmitted in the course of sending an e-mail is Article 6 (1) lit. f EUGDPR. If the e-mail contact aims to conclude a contract, then additional legal basis for the processing is Art. 6 para. 1 lit. b EUGDPR.
6.3 Purpose of the data processing
The processing of the personal data from the input mask serves us only to process the contact. In the case of contact via e-mail, this also includes the required legitimate interest in the processing of the data.
The other personal data processed during the sending process serve to prevent misuse of the contact form and to ensure the security of our information technology systems.
6.4 Duration of storage
The data will be deleted as soon as it is no longer necessary for the purpose of its collection. For the personal data from the input form of the contact form and those sent by e-mail, this is the case when the respective conversation with the user has ended. The conversation is ended when it can be inferred from the circumstances that the relevant facts have been finally clarified.
The additional personal data collected during the sending process will be deleted at the latest after a period of seven days.
6.5 Opposition and elimination possibilities
The user has the possibility at any time to revoke his consent to the processing of the personal data. If the user contacts us by e-mail, he may object to the storage of his personal data at any time. In such a case, the conversation cannot continue.
You can revoke your consent at any time and object to the storage by sending us an informal e-mail to the following address: email@example.com
All personal data stored in the course of contacting will be deleted in this case.
7. Rights of the person concerned
If any personal data on you is processed by any data controller (like us), you are called the "data subject" within the context of the EUGDPR and you are entitled to enforce the following rights towards us as the data controller. You may exercise your rights by contacting our Privacy Officer or the Service Center staff, indicating your concerns or your decisions in regard to your personal data.
7.1 Right to information
Any person concerned by the processing of personal data shall have the right at any time to obtain from the data controller any information concerning the personal data stored about him or her and a copy of such data and free of charge.
You may ask the person in charge to confirm if personal data concerning you is processed by us.
7.2 Right to rectification
Any person affected by the processing of personal data has the right to demand the immediate correction of incorrect personal data concerning him or her. Furthermore, the data subject has the right to request the completion of incomplete personal data, including by means of a supplementary declaration, taking into account the purposes of the processing.
7.3 Right to restriction of processing
Any person affected by the processing of personal data has the right to require the controller to restrict the processing if the conditions laid down by the legislator in Article 18 (1) of the EUGDPR are met.
7.4 Right to cancellation
Any person affected by the processing of personal data has the right to require the data controller to delete the personal data concerning him / her immediately, provided that one of the reasons stated in Article 17 (1) of the EUGDPR applies.
7.5 Right to Data Portability
Any person affected by the processing of personal data shall have the right to receive in a structured, common and machine-readable format personal data relating to him / her which is to be provided by the data controller. The data subject also has the right to transfer this data to another data controller without hindrance us, provided that the processing is based on the consent pursuant to Article 6 (1) (a) of the EUGDPR or Article 9 (1) (b) 2 (a) of the EUGDPR or on a contract pursuant to Article 6 (1) (b) of the EUGDPR and that the processing is carried out using automated procedures.
7.6 Right to object
Any person affected by the processing of personal data shall have the right, at any time and for reasons arising from his or her particular situation, to prevent the processing of personal data relating to them pursuant to Article 6 (1) (e) or (f) of the EUGDPR, by lodging an objection with the Data Controller. This also applies to profiling based on these provisions.
In the event of an objection, the Data Controller will no longer processes the Data Subject’s personal data unless the Data Controller can establish compelling and legitimate grounds for continued processing and such grounds outweigh the interests, rights and freedoms of the data subject, or when continued processing is aimed at asserting, exercising or defending legitimate legal claims.
If the company processes personal data in order to operate direct mail, the data subject has the right to object at any time to the processing of personal data for the purpose of such advertising. This also applies to the profiling, as far as it is associated with such direct mail. If the data subject objects to the processing of personal data for the purposes direct marketing, the personal data will no longer be processed for those purposes.
7.7 Right to revoke the data protection consent declaration
Any person affected by the processing of personal data has the right to withdraw consent to the processing of personal data at any time.
You have the right to revoke your data protection declaration at any time. The revocation of consent does not affect the legality of the processing carried out on the basis of the consent until the revocation.
7.8 Right to complain to a supervisory authority
Without prejudice to any other administrative or judicial remedy, you shall have the right to complain to a supervisory authority, in particular in the Member State/Country of your residence, place of work or place of alleged infringement, if you believe that the processing of the personal data concerning you infringes the EUGDPR
8. Data protection regulations for the use and use of Google Analytics (with anonymization function)
The data controller has integrated the component,Google Analytics (with anonymisation function), on its website. Google Analytics is a web analytics service. Web analysis is the collection, collection and analysis of data about the behavior of visitors to websites. Among other things, a web analysis service collects data on which website a person has come to a website (so-called referrers), which subpages of the website were accessed or how often and for which length of stay a subpage was viewed. Web analytics is used primarily to optimize a website and cost-benefit analysis of Internet advertising.
The operating company of the Google Analytics component is Google Inc., 1600 Amphitheater Pkwy, Mountain View, CA 94043-1351, USA.
The controller uses the addition "_gat._anonymizeIp" for web analytics via Google Analytics. By means of this addendum, the IP address of the person's Internet connection will be shortened and anonymised by Google if the access to our website is from a Member State of the European Union or from another state party to the Agreement on the European Economic Area.
The purpose of the Google Analytics component is to analyze visitor flows on our website. Among other things, Google uses the data and information obtained to evaluate the use of our website, to compile for us online reports that show the activities on our websites, and to provide other services related to the use of our website.
Google Analytics uses a cookie on the information technology system of the person concerned. What cookies are, has already been explained above. By using this cookie Google is enabled to analyze the use of our website. Each time one of the pages of this website is accessed by the controller and a Google Analytics component has been integrated, the Internet browser on the information technology system of the person concerned is automatically initiated by the respective Google Analytics component To submit data to Google for online analysis purposes. In the course of this technical process, Google receives knowledge about personal data, such as the IP address of the person concerned, which is used by Google, among other things,
The cookie stores personally identifiable information, such as access time, the location from which access was made and the frequency of site visits by the data subject. Each time you visit our web pages, your personal information, including the IP address of the Internet connection used by the data subject, is transferred to Google in the United States of America. This personal information is stored by Google in the United States of America. Google may transfer such personal data collected through the technical process to third parties.
The affected person can prevent the setting of cookies by our website, as already shown above, at any time by means of a corresponding setting of the Internet browser used and thus permanently contradict the setting of cookies. Such a setting of the Internet browser used would also prevent Google from setting a cookie on the information technology system of the person concerned. In addition, a cookie already set by Google Analytics can be deleted at any time via the Internet browser or other software programs.
The data controller has integrated Google AdWords on this website. Google AdWords is an Internet advertising service that allows advertisers to run both Google and Google Network search engine results. Google AdWords allows an advertiser to pre-set keywords that will display an ad on Google's search engine results only when the search engine retrieves a keyword-related search result. On the Google Network, ads are distributed to topic-relevant Web pages using an automated algorithm and according to pre-defined keywords.
The operating company for the services of Google AdWords is Google Inc., 1600 Amphitheater Pkwy, Mountain View, CA 94043-1351, USA.
The purpose of Google AdWords is to promote our website by displaying interest-based advertising on third-party websites and in the search engine results of the search engine Google, and by displaying advertisements on our website.
If an affected person reaches our website via a Google ad, a so-called conversion cookie will be deposited on Google's information technology system by Google. What cookies are, has already been explained above. A conversion cookie expires after thirty days and is not used to identify the data subject. About the conversion cookie, if the cookie has not yet expired, traced whether certain sub-pages, such as the shopping cart from an online shop system, were accessed on our website. The conversion cookie tells both us and Google whether an affected person who came to our website via an AdWords ad generated revenue, ie, completed or canceled a purchase.
The data and information collected through the use of the conversion cookie is used by Google to provide visitor statistics for our website. These visit statistics are then used by us to determine the total number of users who have been sent to us through AdWords ads, in order to determine the success or failure of each AdWords ad and to optimize our AdWords ads for the future , Neither our company nor any other Google AdWords advertiser receives any information from Google that could identify the data subject.
The conversion cookie stores personal information, such as the web pages visited by the affected person. Each time you visit our web pages, your personal information, including the IP address of the Internet connection used by the data subject, will be transferred to Google in the United States of America. This personal information is stored by Google in the United States of America. Google may transfer such personal data collected through the technical process to third parties.
The affected person can prevent the setting of cookies by our website, as already shown above, at any time by means of a corresponding setting of the Internet browser used and thus permanently contradict the setting of cookies. Such a setting of the Internet browser used would also prevent Google from setting a conversion cookie on the information technology system of the person concerned. In addition, a cookie already set by Google AdWords can be deleted at any time via the Internet browser or other software programs.
Furthermore, the data subject has the opportunity to object to Google's interest-based advertising. To do this, the person concerned must access the link www.google.com/settings/ads from each of the Internet browsers they use and make the desired settings there.
The controller has integrated YouTube components on this website. YouTube is an internet video portal that allows video publishers to freely watch video clips and other users for free viewing, rating and commenting. YouTube allows the publication of all types of videos, so that both complete film and television broadcasts, but also music videos, trailers or user-made videos via the Internet portal are available.
YouTube's operating company is YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. YouTube, LLC is a subsidiary of Google Inc., 1600 Amphitheater Pkwy, Mountain View, CA 94043-1351, USA.
Each time one of the pages of this website is accessed by the controller and a YouTube component (YouTube video) has been integrated, the Internet browser on the subject's information technology system will automatically be activated by the respective YouTube component to download an illustration of the corresponding YouTube component from YouTube.
More information about YouTube can be found at https://www.youtube.com/yt/about/en/ . As part of this technical process, YouTube and Google are aware of the specific bottom of our site being visited by the data subject.
If the data subject is logged in to YouTube at the same time, YouTube recognizes by calling a subpage containing a YouTube video which specific subpage of our website the affected person visits. This information is collected by YouTube and Google and associated with the individual YouTube account.
YouTube and Google always receive information through the YouTube component that the data subject has visited our website if the data subject is simultaneously logged into YouTube at the time of accessing our website; this happens regardless of whether the person clicks on a YouTube video or not. If such transfer of this information to YouTube and Google is not wanted by the data subject, it can prevent the transfer by logging out of their YouTube account before calling our website.
11. Pixel Tracking and Usage Based Online Advertising (OBA)
- Doubleclick - https://policies.google.com/privacy/update?hl=en
- AdWords - https://policies.google.com/privacy/update?hl=en
- The Trade Desk - https://www.thetradedesk.com/general/privacy-policy
- Outbrain - https://www.outbrain.com/legal/privacy#amplify-terms-us
- Facebook - https://www.facebook.com/privacy/explanation
Third-party technologies Doubleclick, AdWords, The Trade Desk, Outbrain and Facebook allow advertisers who are already interested in our site to interact with affiliate sites and social media sites. The technologies work completely anonymized, no personal data (eg IP address or similar) are stored and no user profiles are combined with personal data. The use by you as a person is not evaluated, but the usage history of your internet browser (browser type, pages visited, visiting hours, length of stay, referrer URLs, viewed ads, clicked advertising banners, etc.). This not only gives you general, but also ads tailored to web usage on your computer. On the other hand, the collected information is also processed for reporting purposes, for example, to check the effectiveness of advertising campaigns or advertisements, for example to generate statistics on how many times clicking on advertisements has led to a purchase or further action on the advertiser's website. Both the display of the advertising and the reporting are completely anonymous.
www.networkadvertising.org/choices/ or http://optout.aboutads.info .
12. Social Plugins
The data controller uses so-
called social plugins of various social networks on its website; these are described individually in this section.
When using the plugins, your Internet browser establishes a direct connection to the servers of the respective social network. As a result, the respective provider receives the information that your Internet browser has accessed the corresponding page of our online service, even if you do not have a user account with the provider or are currently not logged into this. Log files (including the IP address) are transmitted from your Internet browser directly to a server of the respective provider and possibly stored there. The provider or its server may be located outside the EU or the EEA (eg in the USA).
The plugins represent independent extensions of the providers of social networks. Therefore, we have no influence on the extent of the collected and stored by the providers of social networks through the plugins data.
If you do not want social media providers to process data through this online offering, you should not use the plugins.
With the so-called 2-click solution (provided by Heise Media GmbH & Co. KG), SAT protects you from the fact that your visit to our web pages is recorded and evaluated as standard by providers of social networks. If you visit a page of our website that contains such plugins, these are initially disabled. Only when you click the provided button, the plugins are activated.
12.1 Facebook "Share" button
Our website includes the Facebook "Share" button, a Facebook social networking plug-in (Facebook Inc., 1601 South California Ave., Palo Alto, CA 94304, USA (Facebook)). The content of this plugin is inserted by Facebook directly into your browser. If you activate the share button with the first click, a direct connection is established between your browser and the Facebook servers, and Facebook receives the information that you have accessed our website with your IP address. If you are logged in to your Facebook profile, you can link the contents of our website to your Facebook profile by clicking the "Share" button. If you are not a member of Facebook, there is still the possibility that Facebook will find out and save your IP address.
For more information, see the Facebook Data Use Policy: http://www.facebook.com/about/privacy/
If you are a Facebook member and do not want Facebook to process data about you via our website and assign it to your Facebook account, you must log out of Facebook before visiting our website. It is also possible to block Facebook social plugins with add-ons for your browser in general, for example with the "Facebook Blocker": http://webgraph.com/resources/facebookblocker/
12.2 "Tweet" button from Twitter
Our website also includes the "Tweet" button, a plugin from the Twitter social network (Twitter Inc., 1355 Market St, Suite 900, San Francisco, CA 94103, USA (Twitter)). The content of this plugin is inserted by Twitter directly into your browser. If you activate the "Tweet" button with the first click, a direct connection is established between your browser and the servers of Twitter, and Twitter receives the information that you have accessed our website with your IP address. If you are logged in to your Twitter profile, you can use the "Tweet" button to link content from our website to your Twitter profile. If you are not a member of Twitter, there is still the possibility that Twitter will find out and save your IP address.
If you have a Twitter account and do not want Twitter to collect information about you from your stay on our website and link it to your data on Twitter, log out of Twitter before visiting our website.
It is also possible to block Twitter social plugins with add-ons for your browser, for example with the "Twitter Blocker" (https://disconnect.me).
12.3 Pinterest "Pin" Button
Our website also includes the "Pin" button, a Pinterest social networking plugin (Pinterest Europe Ltd. Palmerston House, 2nd floor Fenian Street Dublin 2, Ireland (Pinterest)). The content of this plugin is inserted directly into your browser by Pinterest. If you activate the "pin" button with the first click, a direct connection between your browser and the servers of Pinterest will be established, and Pinterest will receive the information that you have accessed our website with your IP address.
If you are logged in to your Pinterest profile, you can link contents of our website to your Pinterest profile by clicking the "Pin" button. If you are not a member of Pinterest, there is still the possibility that Pinterest will learn and store your IP address.
If you have a Pinterest account and do not want Pinterest to collect information about you during your stay on our website and associate it with your information on Pinterest, log out of Pinterest before visiting our website.
It is also possible to block Pinterest Social Plugins with add-ons for your browser, for example with the "Pinterest Blocker" (https://disconnect.me).
13. Links to websites of other providers
As of 25 May 2018