Privacy Policy - GDPR (Europe)

This Privacy Policy has been prepared in accordance with the General Data Protection Regulation (GDPR - Regulation EU 2016/679) and describes how PlayTour collects, uses, stores and protects your personal data.

1. Legal Foundations

The processing of personal data by PlayTour is based on the following legal bases provided in Art. 6 of the GDPR:

• Consent of the data subject
• Performance of a contract or pre-contractual measures
• Compliance with a legal obligation
• Protection of vital interests
• Performance of a task in the public interest
• Legitimate interests of the controller

2. Data Subject Rights

Under the GDPR, you have the following rights:

• Right of access (Art. 15): Obtain confirmation and access to your personal data
• Right to rectification (Art. 16): Correct inaccurate or incomplete data
• Right to erasure (Art. 17): Request deletion of your personal data
• Right to restrict processing (Art. 18): Limit the processing of your data
• Right to data portability (Art. 20): Receive your data in a structured format
• Right to object (Art. 21): Object to processing based on legitimate interests
• Rights related to automated decision-making (Art. 22): Not be subject to automated decisions

3. Legal Bases for Processing

4. Special Categories of Data

According to Art. 9 of the GDPR, special categories of personal data are processed only when:

• Explicit consent has been given
• Processing is necessary for employment or social security purposes
• Processing is necessary to protect vital interests
• Processing relates to data manifestly made public by the data subject
• Processing is necessary for legal claims or judicial proceedings

5. Data Protection Officer (DPO)

6. International Data Transfers

When transferring personal data outside the European Economic Area (EEA), we ensure:

• Adequacy decisions by the European Commission
• Standard Contractual Clauses (SCCs) approved by the Commission
• Binding Corporate Rules (BCRs) when applicable
• Certification mechanisms and codes of conduct
• Explicit consent for specific transfers when required

7. Data Breach Notification

In accordance with Art. 33 and 34 of the GDPR:

• We will notify the supervisory authority within 72 hours of becoming aware of a breach
• Data subjects will be informed without undue delay if there is a high risk to their rights
• We maintain a record of all personal data breaches
• We implement appropriate technical and organizational measures to prevent breaches

8. Data Protection Impact Assessment (DPIA)

We conduct DPIAs when processing is likely to result in high risk to data subjects, particularly for:

• Systematic and extensive evaluation based on automated processing
• Processing of special categories of data on a large scale
• Systematic monitoring of publicly accessible areas on a large scale
• New technologies or innovative processing methods

9. Data Retention

10. Supervisory Authority

You have the right to lodge a complaint with your local supervisory authority. For EU residents, you can find your local authority at:

European Data Protection Board - Member Authorities

11. Contact Information

Last updated: 11/30/2025