§ 1 Introduction
The protection of your personal data is very important to us, Scandlines Danmark ApS, Scandlines Gedser – Rostock ApS, Scandlines Catering ApS, Scandlines Deutschland GmbH, Scandlines Bordershop Rostock GmbH and Scandlines Bordershop Puttgarden GmbH (hereinafter “Scandlines”). Scandlines has therefore taken steps to ensure the protection of your personal data and to comply with applicable data protection laws, including the EU Data Protection Regulation (“GDPR”).
Scandlines is the data controller with respect to processing your personal data. You can find contact detail for Scandlines at the bottom of this page. For Scandlines Deutschland GmbH, Scandlines Bordershop Puttgarden GmbH and Scandlines Bordershop Rostock GmbH, an external data protection officer is appointed. Also these contact details can be found at the bottom of this page.
This data protection statement specifies which personal data will be collected when you order tickets or other services, sign up for Scandlines’ loyalty program, SMILE, and when you use the websites we operate within Scandlines. As of May 2018 we operate the following websites: smile.scandlines.com, scandlines.dk, scandlines.de, scandlines.com, scandlines.se, scandlines.pl, scandlines.nl, scandlines-freight.com, puttgarden.border-shop.dk, puttgarden.bordershoppa.se, rostock.border-shop.dk and rostock.bordershoppa.se (hereinafter referred to jointly as the “website”).
This data protection statement also specifies the purposes for which your personal data will be processed and explains the rights to which you are entitled in this respect. Personal data are any individual details about the personal or factual circumstances of an identified or identifiable natural person. This includes, for example, name, address, telephone number and e-mail address, IP address and any other data, which can be traced back to you.
§ 2 Collection and use of data
Every time the website is accessed, your browser will transfer the following information to us for technical reasons:
- the page from which the file was requested,
- the name and the directory in which the file can be found,
- the date and time of the request,
- the amount of data transferred,
- the access status (transfer file, file not found, etc.),
- a description of the type of web browser used,
- the client IP address.
This data will only be used to enable the technical operation of the website and evaluated by us exclusively for statistical purposes. This use is justified under art. 6(1)f of the GDPR as it is necessary for fulfilling our legitimate interest in providing, operating and improving the website. This information will not be stored in a manner that relates to a particular person and it will not be combined with other data sources. Your IP address will be promptly deleted following your visit to our website.
If there is the possibility of entering personal data on our website (as specified in § 4) in particular for ordering tickets, other services or general inquiries, you can do this on a voluntary basis. Scandlines will only use your personal data to fulfil the respective purpose, i.e. the fulfilment of the contractual relationship (cf. art. 6(1)b of the GDPR) or to provide requested information (cf. art. 6(1)b or f of the GDPR), unless you have granted us your separate explicit consent for more far-reaching use of the data.
Data regarding your browsing behavior on websites within Scandlines is tracked via cookies and pixels. Scandlines will obtain your consent before using cookies to trace your behavior on its websites.
§ 3 SMILE program
This section gives you information about your personal data as a member of the SMILE program.
The SMILE program is provided by Scandlines Danmark ApS, Havneholmen 25, 8th floor, DK-1561 Copenhagen V.
Scandlines Danmark ApS is responsible for the handling of your personal data within the SMILE program and that the handling is being done in accordance with the relevant and applicable mandatory rules regarding protection of personal data. Scandlines is the data controller according to the applicable rules on protection of personal data, including the GDPR.
By becoming a member of the SMILE program, we may ask you for your explicit consent to the following during the registration process:
The categories of personal data we process
Scandlines processes the following categories of non-sensitive personal data about you:
- Contact detail (such as name, email, home address, phone number)
- Travel frequencies
- Browsing behavior (provided that we have obtain your prior consent)
- Purchase history made via your SMILE card (price, location and number of products)
- Your communication history with Scandlines.
The Purposes and legal basis for processing your personal data
Application and Purchases
Scandlines will register and use the data that is required in the SMILE application form. In the SMILE application form you will be asked to provide your name, your e-mail address, your home address, your telephone number and your travel frequencies.
Scandlines will register and use data regarding your purchases (price, location and number of products) made via your SMILE card.
Scandlines processes the abovementioned personal data in order to fulfil its obligation towards you, namely creating a profile for you and calculating your SMILE points. The legal basis for this processing follows from article 6(1)b of the GDPR.
Furthermore, answers to questions from Scandlines related to your purchases and other information you may provide to Scandlines in relation to purchases will be registered and used to update Scandlines’ knowledge on customer preferences enabling Scandlines to follow its legitimate purposes in providing better service to you including targeted marketing towards you.
The legal basis for this processing is the balancing of interest rule, cf. article 6(1)f of the GDPR. Please note that you have the right to object to Scandlines’ processing of your personal data based on the balancing of interest rule and for the purposes of direct marketing. See “YOUR RIGHTS” below.
During the SMILE registration process, you have to give a separate explicit consent that allows us to use your personal data to send you newsletters via e-mail. These newsletters will contain, inter alia, tips on travel, information regarding new products and new advantages and invitations to participate in competitions. The content of the newsletter is based on the information we have collected in your customer profile. If you hereafter decide to opt out of receiving electronic communication you will only receive 2 annual service emails from SMILE stating your point balance and information on the expiry date of your points.
The legal basis for processing your personal to send newsletters is therefore your consent cf. article 6(1)a of the GDPR.
Scandlines will use your personal data for marketing of our products and services and for conducting questionnaire surveys.
In this regard your personal data may be shared with social media operators (such as Facebook) for the sole purpose of marketing of products and services from Scandlines via these social media.
The legal basis for this processing is your explicitly given consent cf. article 6(1)a of the GDPR.
§ 4 - RECIPIENTS OF YOUR PERSONAL DATA
Scandlines may share your personal data with companies within the Scandlines group (i.e. the companies mentioned in section 1 above) for the abovementioned purposes, including allocating SMILE points based on your purchases made in one of the Scandlines companies.
Scandlines may also share your personal data with social media such as Facebook for the purposes of marketing via these media.
Scandlines may also engage third parties to store and process your personal data on our behalf, e.g. hosting providers and Google Analytics (see also § 8 below). Such recipients are data processors pursuant to applicable data protection laws and may only process your personal data in accordance with documented instructions from us. Scandlines has ensured that such third parties have implemented the necessary safety measures in order to protect your personal data.
Your personal data may also be shared from time to time with partners conducting questionnaire surveys for the sole purpose of conducting questionnaire surveys on behalf of Scandlines.
§ 5 - TRANSFER OF PERSONAL DATA OUTSIDE THE EU/EEA
Scandlines makes use of third party data hosting companies located outside of EU and the EEA, e.g. in the USA, to store and process your personal data collected by us.
All data transfers to such third parties will be subject to a written contract between us and the third party in question to ensure full compliance with the EU regulation on data protection. The contract will either be concluded on the basis on the EU Commissions Model Clauses or concluded with a company, which is certified under the EU-US Privacy Shield framework.
The third party will only be authorized to process personal data according to our instructions.
You are at any time entitled to request a copy from Scandlines of the guarantees regarding data protection guaranteed by the third party in question.
§ 6 – RETENTION PERIOD
Information you provided to us via the website will in general only be stored for the time period it is required to fulfil the contract with you or to respond to your inquiry. Where statutory longer retention periods apply, the data may be stored for a longer period in compliance with these obligations and also in case of an individual legitimate interest (e.g. in case of a legal dispute).
Information regarding your SMILE point related purchases will be deleted one year after the said points are statute-barred, cf. Section 7 of the SMILE terms. Our SMILE terms can be accessed on https://smile.scandlines.com/en/Terms
Information regarding name, e-mail address, home address, telephone number and travel frequencies will be kept for one year after the last points on your account have been statue-barred or your membership has been terminated, unless you specifically asked us to delete your data previously.
In regard to your right of information, correction, deletion or blocking § 9 below applies. If you request that Scandlines delete all your data and if consequently a further membership is not possible anymore without such data, the termination rules in Section 9 of the SMILE terms will apply accordingly.