PRIVACY POLICY

An Overview of Data Protection

General Information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data with which you can be personally identified. Detailed information on the subject of data protection can be found in our Privacy Policy listed below.

Data Recording on This Website

"Who is responsible for the data recording on this website (i.e., the "controller")?"
The data on this website is processed by the website operator. The operator’s contact details can be found in the "Legal Notice" section of this website.

How do we collect your data?

On one hand, your data is collected when you share it with us. This can, for example, be information you enter into a contact form, when requesting a brochure, or when subscribing to our newsletter ("My Bluedrift Journal").
Other data is recorded automatically by our IT systems when you visit the website. This data is primarily technical information (e.g., system browser, operating system, or time of page access) and is recorded automatically as soon as you enter this website.

What do we use your data for?

Part of the data is collected to ensure the website functions flawlessly and securely. Other data can be used to analyze how visitors use the site, process your booking requests, or send you our journal/newsletter if you have actively subscribed.

What rights do you have regarding your data?

You have the right to receive information about the source, recipients, and purposes of your archived personal data at any time free of charge. You also have the right to demand that your data be rectified or erased. If you have given your consent to data processing, you can revoke this consent at any time, which will affect all future data processing. You also have the right to object to the processing of your data and to request that the processing of your personal data be restricted under certain circumstances. Furthermore, you have the right to lodge a complaint with the competent supervising authority.

General Information and Mandatory Information

Data Protection

The operators of this website take the protection of your personal data very seriously. We treat your personal data as confidential and in accordance with the statutory data protection regulations (GDPR/ DSGVO, TDDDG) and this Privacy Policy.
If you use this website, various category-specific personal data will be collected. Personal data is data with which you can be personally identified. This Privacy Policy explains what information we collect and what we use it for. It also explains how and for what purpose this happens.
We point out that data transmission over the Internet (e.g., when communicating by email) can have security gaps. A complete protection of data against access by third parties is not possible.

Information about the Responsible Party (referred to as the "Controller")

The data processing controller on this website is:

my Bluedrift
Lena Jasmin Stier
Bernstorffstraße 18

13507 Berlin

Germany
Email: my.bluedrift@icloud.com

The controller is the natural or legal person who single-handedly or jointly with others decides on the purposes and resources of the processing of personal data (e.g., names, email addresses, etc.).

Storage Duration

Unless a more specific storage period has been specified in this privacy policy, your personal data will remain with us until the purpose for processing the data no longer applies. If you assert a justified request for deletion or revoke your consent to data processing, your data will be deleted, unless we have other legally permissible reasons for storing your personal data (e.g., tax or commercial law retention periods); in the latter case, the deletion will take place after these reasons cease to apply.

Legal Bases for Data Processing

Where you have given your consent, we process personal data pursuant to Art. 6 (1) (a) GDPR and § 25 (1) TDDDG (for storage or accessing information on the user's end device). Where processing is necessary for the performance of a contract or pre-contractual measures (e.g., expedition inquiries or bookings), it is based on Art. 6 (1) (b) GDPR. Where processing is required to comply with a legal obligation, it is based on Art. 6 (1) (c) GDPR. Processing may also be based on our legitimate interest pursuant to Art. 6 (1) (f) GDPR.

Revocation of Your Consent to Data Processing

Many data processing operations are only possible with your express consent. You can revoke your consent at any time. The legality of the data processing carried out before the revocation remains unaffected by the revocation.

Right to Object to Data Collection in Special Cases (Art. 21 GDPR)

IF THE DATA PROCESSING IS BASED ON ART. 6 SECT. 1 LIT. E OR F GDPR, YOU HAVE THE RIGHT TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA AT ANY TIME FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION. THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR PERSONAL DATA, UNLESS WE CAN PROVE COMPELLING REASONS FOR THE PROCESSING WORTHY OF PROTECTION WHICH OUTWEIGH YOUR INTERESTS, RIGHTS, AND FREEDOMS OR THE PROCESSING SERVES THE ASSERTION, EXERCISE, OR DEFENSE OF LEGAL CLAIMS (OBJECTION PURSUANT TO ART. 21 SECT. 1 GDPR).

Right to Lodge a Complaint with the Competent Supervisory Authority

In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work, or place of the alleged violation. The right to lodge a complaint is without prejudice to any other administrative or judicial remedy.

Right to Data Portability

You have the right to have data that we process automatically on the basis of your consent or in fulfillment of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done to the extent technically feasible.

SSL or TLS Encryption

This site uses SSL or TLS encryption for security reasons and to protect the transmission of confidential content, such as inquiries or bookings that you send to us as the site operator. You can recognize an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser line.
If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

Information, Erasure, and Rectification

Within the framework of the applicable statutory provisions, you have the right to free information about your stored personal data, its origin and recipient, and the purpose of the data processing and, if necessary, a right to rectification or erasure of this data at any time. You can contact us at any time using the address given in our Legal Notice if you have further questions on the subject of personal data.

Right to Restriction of Processing

You have the right to request the restriction of the processing of your personal data. You can contact us at any time at the address given in the Legal Notice.

Consent Management Technology: Usercentrics

Usercentrics Consent Management Platform (CMP)

Our website uses the Usercentrics Consent Management Platform to obtain and manage your legally required consent for storing cookies or using tracking and web technologies on your device, and to document this consent in a GDPR-compliant manner.

Provider:
Usercentrics GmbH
Sendlinger Str. 7
80331 Munich, Germany
Website: https://usercentrics.com/

Function & Processed Data:

When you visit our website, a connection is established with Usercentrics' servers to display the privacy settings banner ("Privacy Settings") and obtain your consent preferences (e.g., "Accept All", "Deny", "Save Settings"). Usercentrics stores a cookie in your browser to remember your choices across pages and future visits.

The following data is processed:

Your consent or revocation status (Opt-in / Opt-out preferences)
Timestamp of consent
Device information (e.g., browser type, operating system, language settings)
Anonymized / hashed IP address
Usercentrics Consent ID and version of the consent banner

Legal Basis:

The use of Usercentrics CMP is carried out to fulfill our legal obligations to obtain and document GDPR-compliant consent (Art. 6 (1) (c) GDPR in conjunction with § 25 (1) TDDDG). Furthermore, we have a legitimate interest in providing a transparent, user-friendly, and legally compliant consent mechanism (Art. 6 (1) (f) GDPR).

Storage Duration:

The consent preferences recorded by Usercentrics remain stored on your end device until you delete the Usercentrics cookie, revoke your consent, or the purpose for data storage no longer applies. Statutory retention periods remain unaffected.

Data Processing Agreement (DPA):

We have concluded a Data Processing Agreement (DPA / Auftragsverarbeitungsvertrag) with Usercentrics GmbH. This contract ensures that Usercentrics processes website visitors' personal data strictly according to our instructions and in compliance with GDPR standards.

Data Collection on Our Website

Cookies and Local Storage

Our website uses cookies and technical storage elements. Cookies are small text files stored on your end device.

They do not harm your device.

Session Cookies: Automatically deleted after you close your browser.
Persistent Cookies: Remain stored on your device until you delete them or they expire.
Necessary Cookies: Technically required for basic website functionality (e.g., navigating pages, language settings, security). Legal basis: Art. 6 (1) (f) GDPR / § 25 (2) TDDDG.
Non-Essential / Consent-Required Cookies: Analytics, marketing, or external media technologies are only activated after you actively give consent via the Usercentrics Consent Banner. Legal basis: Art. 6 (1) (a) GDPR / § 25 (1) TDDDG.

You can configure your browser to inform you about cookie settings, allow cookies on a case-by-case basis, exclude cookies generally, or activate automatic deletion upon closing the browser. You can also adjust your cookie preferences at any time via the Usercentrics privacy banner link in our website footer.

Server Log Files

Our website host automatically collects and stores technical information in server log files, which your browser automatically transmits:

Browser type and version
Operating system used
Referrer URL (previously visited page)
Host name of the accessing computer
Date and time of server request
IP address (anonymized)

This data is not merged with other data sources. Collection is based on Art. 6 (1) (f) GDPR (our legitimate interest in technical troubleshooting, system security, and optimization of the website).

Contact Forms, Brochure Requests, and Booking Inquiries

If you send us an inquiry via our contact form or request our travel brochure (e.g., "The Wild Coast Expedition" brochure), the information provided in the form (e.g., name, email address, phone number, diving certification/experience, room preferences, custom message) is stored to process your inquiry and handle follow-up questions.

Legal basis: Art. 6 (1) (b) GDPR (processing necessary for pre-contractual measures and expedition preparation) and Art. 6 (1) (f) GDPR (effective handling of customer communications). Data is retained until the inquiry purpose is fulfilled, or statutory retention duties apply.

Newsletter Data (My Bluedrift Journal)

If you subscribe to our journal/newsletter ("My Bluedrift Journal"), we collect your email address and process it to send you travel stories, expedition updates, reflections, and news from my Bluedrift.

Double Opt-In Procedure:
To prevent unauthorized sign-ups, we use a Double Opt-In process. After entering your email address, you receive a confirmation email with an activation link. You are only added to our mailing list after clicking this link.

Legal Basis:
Processing is based exclusively on your explicit consent pursuant to Art. 6 (1) (a) GDPR.

Revocation & Unsubscribe:
You can revoke your consent to store your email address and receive the journal at any time by clicking the "Unsubscribe" link in any newsletter issue or by sending an email to my.bluedrift@icloud.com.

Suppression List (Blacklist):
After un-subscribing, your email address may be stored in an internal suppression list (blacklist) to permanently prevent future automated mailings to your address. This serves your interest and our legitimate interest in legal compliance (Art. 6 (1) (f) GDPR).

Hosting & Social Media

Wix / Squarespace Hosting

Our website is hosted by an external service provider (e.g., Wix.com Ltd. / Squarespace Ireland Ltd.). Personal data collected on this website (e.g., IP addresses, contact requests, server metadata) is stored on the host's secure servers.

Legal basis: Art. 6 (1) (b) GDPR (contract performance) and Art. 6 (1) (f) GDPR (secure, fast, and professional website provision). [UPDATED] We have concluded a Data Processing Agreement (DPA) with our hosting provider to ensure GDPR compliance.

Social Media Links (Instagram)

Our website features direct text/icon links to our official Instagram profile (https://www.instagram.com/lena.bluedrift/).
These are static hyperlinks and not active social plugins (such as embedded tracking pixels or like buttons). No personal data is transmitted to Instagram (Meta Platforms Ireland Ltd.) simply by viewing our website. Data is only transmitted when you actively click the Instagram link to visit our external profile.