Privacy notice

The controller for data processing on this website is TRALLAFITTY UG (haftungsbeschränkt), Otto-Ernst-Str. 25, 22605 Hamburg, email: hello@trallafitty.com.

Data protection officer or contact for privacy questions: Timo Angerstein, Tobias Grimm (hello@trallafitty.com).

When you open our pages, our server processes technically necessary data: IP address, date and time, requested page, status code, data volume and browser and device type. The purpose is delivering the pages, their stability and security. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure operation).

We keep these log data for 7 days and then delete them. They are not linked with other data. We also use the log data for aggregated page-request counts; we do not track individuals.

To protect against abuse, such as forms being submitted in bulk, we count requests per IP address and per email address. We store these counters only as a pseudonymised check value and delete them after one day at the latest (Art. 6(1)(f) GDPR).

Hosting: [to be added before launch] (processor, location: [to be added before launch]).

We do not use tracking or marketing cookies and do not embed third-party content – no external fonts, maps, videos, social-media plugins or analytics services. That is why this website has no cookie banner.

The only entries that are technically necessary, and therefore permitted without consent under § 25(2) no. 2 TDDDG, are those listed in full on the privacy settings page: a sign-in cookie when you sign in to the secure area, a confirmation cookie for 30 minutes after you confirm your email address, your “Reduce motion” setting, and short-lived entries in your browser’s session storage when you use the form, the survey or the carrying-over of interests. They are only created when you use the function concerned and are not used to recognise you across websites or devices.

Which data

Your email address and chosen language are required. Optional: the number of adults and children, anonymous age bands of the children (no names, no dates of birth), interests, preferred times, first name, phone number, postcode, how you heard about us, your answer to the survey on whether children should be able to attend some activities without a parent in the room, and your votes in the “Have your say” survey. We also store the planned price shown to you with its pricing date and the page of this website from which you opened the form – without cookies and without an identifier.

Why

We keep your registration, confirm your email address, give you access to the secure area and answer your enquiries. We also use the optional details to plan our offer.

Legal basis

Art. 6(1)(b) GDPR (steps prior to a possible contract, at your request); for the optional details Art. 6(1)(a) GDPR (your consent, which you can withdraw at any time).

Required or optional

We cannot keep the registration without an email address. Everything else is optional. The form is intended for adults.

How long

We delete unconfirmed registrations completely after 7 days. We keep confirmed registrations until you withdraw them, at most [to be added before launch]. After you withdraw, we delete your contact, family and interest details within 30 days.

After you submit, we send you exactly one email with a confirmation link; it is valid for 72 hours. We do not send reminders. Your registration is only complete once you click on the confirmation page.

As proof, we log the time of registration and confirmation, the version and wording of the consents given and, where applicable, their withdrawal. The legal bases are Art. 6(1)(c) in conjunction with Art. 7(1) GDPR and Art. 6(1)(f) GDPR (interest in proof and defence).

We keep this proof even after a withdrawal for up to three years from the last event; then we delete it.

Only if you have consented do we send you emails about the status of the waiting list (consent A, “waiting-list notifications”) or news and offers (consent B). The legal basis is Art. 6(1)(a) GDPR in conjunction with § 7(2) no. 2 UWG.

We use no tracking pixels and measure neither opens nor clicks. You can withdraw any consent at any time – in the secure area, via the unsubscribe link in the email concerned or by writing to hello@trallafitty.com. Processing until the withdrawal remains lawful.

Independently of this, we send you service messages about your registration, such as the confirmation email, sign-in links and acknowledgements of your requests.

Any information about your children consists solely of anonymous planning data: number and rough age band. We do not ask for names, dates of birth, health data, photos or location data of children. Please do not provide such data in other fields or by email either.

If you write to us via the contact form, we process the chosen topic, your email address, your message, the language of the page and the time. The purpose is answering your message; for this, an internal notification goes to a mailbox of the operator.

The legal basis is Art. 6(1)(b) GDPR insofar as your message concerns your registration or a possible contract, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). We delete contact messages after 12 months.

You can take part in the “Have your say” survey without signing in. Only after your click do we store a random key in your browser’s session storage, so that the same choice is not counted more than once. On the server this key exists only as a pseudonymised check value; your vote stays anonymous.

Votes you cast after submitting the form or in the secure area are linked to your registration. Publicly we show only aggregated results, and only votes from confirmed registrations count there.

The legal basis is Art. 6(1)(a) GDPR for votes from a registration and Art. 6(1)(f) GDPR for anonymous votes (legitimate interest in learning about preferences for our planning).

After you confirm your email address, you receive a Fitty pass. It has its own web address, which only works once you share it for the first time or copy the link. Saving the image alone does not activate the link.

The pass page shows only the month of your registration and your interests – no names, no email address, no reference, no family details and no information about children. The pass image is created in your browser.

In the secure area you can switch the link off at any time or create a new one; the old link then stops working. If you withdraw your registration, we switch the link off immediately.

Sharing happens only through your own apps: we do not send emails to third parties, and WhatsApp or your device’s share function only open after your click. The legal basis is Art. 6(1)(a) GDPR (your decision to share the pass).

We use the following service providers as processors under Art. 28 GDPR – hosting: [to be added before launch]; email delivery: [to be added before launch]; backup: [to be added before launch]; upstream network (CDN): [to be added before launch].

Transfers to third countries: [to be added before launch]

There are no other recipients. We do not sell data or pass it on for advertising.

The most important periods at a glance:

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21) – in particular, you may object to processing for direct marketing at any time. You can withdraw any consent at any time with effect for the future.

You can exercise many of these rights yourself in the secure area: change your details, manage consents, request your data, request a correction or erasure and withdraw your registration. Otherwise write to hello@trallafitty.com. We reply within one month at the latest.

You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority is: Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI), Ludwig-Erhard-Str. 22, 20459 Hamburg, mailbox@datenschutz.hamburg.de

There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

Transmission is encrypted with TLS. We store confirmation and sign-in links only as a hash; they are short-lived and can be used only once. Access to registrations is restricted by role.

We update this notice when functions of this website change.