Data privacy is a matter of trust, and your trust matters to Virail . It is therefore important to us that your personal data is protected and that its collection, processing and use in relation to Virail ’s services in our app and on our website virail.com complies with the law. In this Policy, we want to tell you about how we collect and use data, in order to give you an overview of how your personal data will be used.
- Name and contact details of the controller responsible for processing and the company’s Data Protection Officer
- The purposes for which data is processed, the legal basis and legitimate interests pursued by Virail or a third party, as well as categories of recipients
3.1. Accessing our website/application
When you access our website/application, the browser used on your device automatically sends information to the server of our website/application and temporarily stores it in what is known as a log file. We have no control over this. The following information will also be collected without any action on your part and be stored until it is automatically deleted:
- the IP address of the requesting internet-enabled device
- the date and time of access
- the name and URL of the retrieved file
- the website/application from which access took place (the Referrer URL)
- the browser you are using, and potentially the operating system of your internet-enabled computer, as well as the name of your access provider
- the device used (e.g., a desktop computer or a smartphone)
- the language of the browser you are using
The legal basis for processing your IP address is Article 6 (1) (f) of the General Data Processing Regulation (GDPR). Our legitimate interest is based on the purposes of data collection listed below. We would like to point out that we are unable to draw any direct conclusions regarding your identity from the data that is collected, and that we refrain from doing so.
We use the IP address of your device and the other data listed above for the following purposes:
- ensuring that a trouble-free connection is established
- ensuring the comfortable use of our website/application
- the evaluation of system security and stability
The data is stored for a period of up to 7 days and is then deleted automatically. We also use what are known as cookies for our website/application, as well as tracking tools, targeting methods and social media plug-ins. The exact procedures used and how your data are used for this purpose are explained in more detail below.
3.2. Bookings and booking requests
We do not offer any travel services but enable booking of travel services on our partner websites.
We redirect to the partner website before continuing with the booking. For the redirection we collect following data:
- Selected arrival and departure day
- Selected arrival and departure cities
Gathering the above listed day is a pre-contractual measure which is required to proceed with contract formation with your partner (on the basis of Article 6 (1) (1) (b) GDPR).
3.3. Cookies – general information
Cookies are small files that your browser automatically creates and that are stored on your device (laptop, tablet, smartphone, etc.) when you visit our website or use our app. Cookies do not harm your device, do not contain viruses, Trojans or other malicious software. The information stored in the cookie is tied to the specific device used. However, this does not mean that we are immediately aware of your identity. In part, cookies are used to make the use of our service more pleasant for you. For example, we use what are known as session cookies to detect that you have already visited individual pages on our website or that you have already logged in to your user account. These are automatically deleted after you leave our website. In addition, to ensure user-friendliness we also use temporary cookies, which are stored on your device for a specific period of time. If you visit our website again to use our services, it is automatically detected that you have already visited us, as well as what information you entered and the settings you used, so that you do not have to reenter them.
3.4. Analytical tools: Google Analytics
In order to customize and continuously optimize our websites in line with users’ needs, we deploy tools on the basis of Article 6 (1) (f) GDPR which permit us to analyze the use of our website.
We use Google Analytics, a web analytics service provided by Google. In doing so, pseudonymized usage profiles are created and cookies are used. The information generated by the cookie about your use of this website, e.g.
- Referrer URL (the previously visited page)
- hostname of the accessing computer (IP address)
The information is used to evaluate the use of the website, to compile reports on the activity on the website, and to provide other services related to the use of the website and internet usage for the purposes of market research and to customize the design of these websites in line with the needs of users. This information may also be transferred to third parties if required by law or if third parties are contracted to process this data. Under no circumstances will your IP address be combined with any other data from Google. The IP addresses are anonymized, which means that it is not possible to identify specific individuals (“IP masking”).
You can prevent the installation of cookies by setting your browser software accordingly. However, disabling cookies completely may mean that you will not be able to use all the features of our website. You may also prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) and the processing of this data by Google by downloading and installing this browser add-on (https://tools.google.com/dlpage/gaoptout?hl=en). As an alternative to the browser add-on, especially for browsers on mobile devices, you can prevent the collection by Google Analytics by clicking on this link. An opt-out cookie will be set which prevents the future collection of your data when you visit this website. The opt-out cookie is only valid in this browser and only for our website and is stored on your device. If you delete the cookies in this browser, you must set the opt-out cookie again. For more information regarding data privacy related to Google Analytics, visit the Google Analytics website: https://support.google.com/analytics/answer/6004245?hl=en.
The targeting measures listed below and used by us are implemented on the basis of Article 6 (1) (f) GDPR. Targeting is used to perform targeted advertising. Through the targeting measures we use, we want to make sure that advertisements which are geared to your interests are displayed on your devices.
3.5.1. Double Click
On our website, information used for the optimization of advertisements is collected and evaluated using cookies (see section 3.6.). To do this, we use Google’s targeting technologies (Double Click). These technologies enable us to provide you with customized, interest-based advertising. The cookies used provide e.g. information regarding which of our products you are interested in. Based on this information, we can also display services on third-party websites that are specifically oriented towards your interests you have shown through your previous user behavior. The collection and evaluation of your user behavior takes place exclusively in pseudonymized manner and does not enable us to identify you. In particular, the information is not combined with personally identifiable information about you.
The cookie is automatically deleted after 30 days.
You can also set preferences for the display of interest-based advertising through the Google Ads Settings Manager (https://adssettings.google.com/authenticated?hl).
3.5.2. Google AdWords
Virail uses Google’s AdWords service, which uses conversion tracking to measure the effectiveness of individual ads, offers and features. For this, a cookie is set as soon as you click on a Google ad. This cookie does not personally identify you, but rather makes it possible to determine whether you return to the page with the specific offer during the 30-day period in which the cookie is valid.
Each AdWords advertiser receives a different cookie. As a result, cookies cannot be tracked via the website of AdWords advertisers. The information obtained using the conversion cookie is used to generate conversion statistics for AdWords advertisers who have opted for conversion tracking. We track the total number of users who have clicked on an ad and were redirected to the website with a conversion-tracking tag.
3.5.3. Google Dynamic Remarketing
We use the features of Google Dynamic Remarketing with the cross-device features of Google AdWords and Google DoubleClick.
This feature allows us to link the advertising audiences created with Google Dynamic Remarketing to the cross-device features of Google AdWords and Google DoubleClick. In this way, interest-based, personalized advertising messages that have been customized for you based on your past usage and browsing behavior on a device (e.g., smartphone) may also be displayed on another device you use (e.g., tablet or PC).
If you have given the appropriate consent to Google, Google will link your web and app browsing history with your Google Account for this purpose. That way, the same personalized advertising messages can appear on any device you use to sign in to your Google Account.
To support this feature, Google Analytics collects Google-authenticated IDs of users who are temporarily linked to our Google Analytics data to define and create audiences for cross-device ad promotion.
You can permanently opt out of cross-device remarketing/targeting by turning off personalized advertising in your Google Account. To do so, follow this link: https://adssettings.google.com/authenticated?hl.
3.5.4. Google AdSense
On our website, we use Google AdSense for displaying advertisements. In this way we can show you advertisements that may be of interest to you. These advertisements can be recognized by the reference “Google Ads”. To do this, Google uses web beacons and cookies (see section 3.6.). The information generated by cookies and web beacons about the use of the website (including your IP address) and delivery of advertising formats is transmitted to a Google server in the US and stored there. Google may share this information with third parties.
We have enabled third-party Google AdSense ads. The data may be transferred to third parties (named at https://support.google.com/dfp_sb/answer/94149).
You can prevent Google AdSense from installing cookies by disabling interest-based ads on Google via the link https://adssettings.google.com/authenticated?hl.
3.5.5. Google AdMob
We use Google AdMob to display ads in the Virail app. Google uses the Apple “Advertising Identifier” (hereafter “Apple Ad-ID”) for advertising control in the app. A pseudonymized user profile is created under the Apple Ad-ID so that the user can be matched to different advertising segments on the Apple advertising platform in order to be able to display interest-based advertising.
The Apple Ad-ID is a pseudonym that prevents personal plain data from being disclosed to Google. The Apple Ad-ID is transmitted to a Google server in the US and stored there.
You can prevent the use of the Apple Ad-ID by clicking on “No Ad-Tracking” under “Privacy/Advertising” in your system settings. Alternatively, you can also click “Reset Ad ID” to generate a new, randomly chosen Apple Ad ID and thus prevent a profile from being generated.
3.5.6. Bing Ads
We use Bing Universal Event Tracking (UET) from Microsoft Bing Ads. This is a service of Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA (“Microsoft”). This allows us to track user activity on our website when users reach our website through advertisements from Bing Ads.
If you reach our website via a Bing Ads advertisement, a cookie will be placed on your computer (see section 3.6.). A Bing UET tag is integrated into our website. This is a code that is used to store data about the use of the website in connection with the cookie. Among others, this includes the time spent on the website, which areas of the website were accessed, and what ads brought users to the website. Information about your identity is not collected.
This information is transmitted to Microsoft servers in the US and stored there for a maximum of 180 days.
Information relevant for European visitors can be found here.
We use ADARA’s cookie to assist with our marketing campaigns in addition to gaining valuable insights to allow ADARA to present more relevant and personalized offers. Information shared through the ADARA cookie is aggregated and anonymous and therefore unable to identify you by your name.
You can opt-out at www.adara.com/opt-out. You can also request your data as well as request deletion of your data from go.adara.com/sar-1018
3.5.9. Travel Audience
Travel Audience operates a data-driven travel advertising platform. We use the cookie from Travel Audience to assist with our marketing campaigns in addition to gaining valuable insights to allow Travel Audience to present more relevant and personalized offers. You can opt-out at https://travelaudience.com/product-privacy-policy/ (7.2f).
Sojern operates a data-driven travel advertising platform. We use the cookie from Sojern to assist with our marketing campaigns in addition to gaining valuable insights to allow Sojern to present more relevant and personalized offers. You can opt-out at https://www.sojern.com/privacy/.
3.6. Option to object/opt-out
You can prevent the targeting technologies we described by activating the appropriate cookie setting in your browser (see also section 3.5.). In addition, you have the option of deactivating preference-based advertising with the help of the preference manager available here: http://www.youronlinechoices.com/uk/your-ad-choices.
4.1. General information
With your consent under Article 6(1)(a) GDPR, you can subscribe our newsletter which will inform you about offers on our Services and from third parties. To sign up for our newsletter, we use the “double opt-in” method. This means that after you have signed up, we will send you an e-mail to the e-mail address specified, in which we ask you to confirm that you wish to receive the newsletter. If you do not confirm your sign-up within 24 hours, your information will be locked and automatically deleted after one month.
In addition, we save the IP addresses you used and the times of sign-up and confirmation. The purpose of the procedure is to verify your sign-up and, if necessary, to inform you about possible misuse of your personal data.
The only requirement for sending the newsletter is your email address. Providing additional data is voluntary and will be used to address you personally. After your confirmation, we will save your e-mail address for the purpose of sending you the newsletter. The legal basis is Article 6(1)(a) GDPR.
You may revoke your consent to receiving the newsletter at any time by clicking the link provided in each newsletter e-mail or by contacting our data protection officer.
4.2. Newsletter Tracking
We use web beacons, tracking pixels and other technologies to track and analyze your interactions with the newsletter. This data is allocated to your e-mail address and a pseudonymized ID. We use this data to generate a user profile to personalise the newsletter for you. Your user profile will be based on the interactions you have with the newsletter, our Services and third-party websites and apps.
You can object to this at any time by using the unsubscribe link provided in each e-mail or by contacting our data protection officer.
Newsletter tracking is not possible if you've deactivated image viewing by default in your e-mail application. In this case, the newsletter will not be displayed in full and you won’t be able to use all the features. If you display images manually, tracking will occur.
- Google Maps
We use Google Maps API for displaying interactive maps directly on our website and to enable the simplified use of map functionality. Your IP address is transmitted and stored on one of Google’s servers in the US for the usage of Google Maps functionality (see section 3.7.1 regarding the US Privacy Shield). Legal basis is (Article 6 (1) (f) GDPR).
If you have any question, please contact our customer service directly at [email protected].
- Your rights
In addition to the right to revoke the consent you have granted to us, you are entitled to the following further rights if the relevant legal requirements apply:
- Right of access to information about your personal data stored with us pursuant to Article 15 GDPR
- Right of rectification of inaccurate personal data and right to have incomplete personal data completed pursuant to Article 16 GDPR
- Right to erasure of your personal data stored by us pursuant to Article 17 GDPR
- Right to restriction of processing of your data pursuant to Article 18 GDPR
- Right to data portability pursuant to Article 20 GDPR
7.2. Right to object
Under the conditions of Article 21 (1) GDPR, data processing can be objected to on grounds relating to the particular situation of the data subject.
General Terms and Conditions (GTC) for the use of the Virail portal
(1) The Virail GmbH, Rosenthaler Str. 72A, 10119 Berlin (hereafter referred to as “virail”) provides a technical interface that enables commercial and private providers of transportation (hereafter referred to as “Providers”), to place transports trips (by train, bus, flight and carpooling) in a database that can be linked with the Providers’ various booking websites. Users seeking accommodation (hereafter referred to as “Users”) shall be granted access to this database via www.virail.com and/or other websites operated by Virail and directed to the website of the Provider of the transportation solution in order to carry out the booking process.
(2) These terms and conditions regulate the use of the database via the aforementioned Virail websites and include access from mobile websites and any application (“App”) developed by Virail as well as any portals or applications for mobile devices provided by third parties. These terms and conditions apply exclusively; Virail rejects the application of any alternative terms and conditions imposed by the User.
(3) The usage of all websites operated by Virail and the provided data bases („Our Website“) is only permitted for private use. A commercial usage of Our Website is explicitly prohibited. Our Website is not to be used for false, fraudulent or speculative reservations, neither for reservations to cover future demand. By using Our Website you confirm to abstain from the following actions and measures without previous written consent by Virail :
– To access our website by using a manual or automated process that exceeds the purpose of personal use or the inclusion of Virail into a search index. The use of automated systems or a software to extract data from Our Website (so called „screen scraping“), is prohibited for non-commercial and commercial purposes.
– To infringe on existing restrictions in robot-exclusion-headers on Our Website or to circumvent measures that restrict or prevent the access to Our Website.
– To use a device, software or program that affects or tries to affect the regular functionality of Our Website, or to carry out an act that inappropriately strains our servers, computer or network.
Virail reserves the right to end, suspend or limit the access to all or specific components of Our Website at our own discretion without previous announcement and under exclusion of any liability.
- Virail services for users
(1) Virail provides a targeted search function that enables Users to identify the most suitable Provider’s offer in the database and then forwards the User to that Provider’s site or puts the User directly in contact with the Provider. Virail is therefore not the service provider for any of these websites. Specifically, the use of Virail services does not give rise to a package travel contract with Virail in the sense of § 651a German Civil Code (BGB).
(2) Where a search returns a large number of results, the results displayed shall be limited to a specific amount to guarantee search functionality.
(3) Users may use the Virail database free of charge.
(4) Virail advises that offers posted by Providers may be subject to a commission in the event of a successful booking contract. The way this contract between the User and the Provider is formed and any content within such contract must be consistent with the law and with any agreement between the two parties concerned.
(5) Virail may permit its services to be provided by third parties.
(6) As Virail provides its services free of charge, the User has no right to damages or the enforcement of the contract. Virail retains the right to cancel the offer at any time without notice.
- Virail is not liable for offers or subsequent booking contracts
(1) Virail is solely the technical services provider, only enabling a search for suitable offers. Virail will not publish their own offers on the aforementioned websites, nor does Virail assume any liability for any offers made. The Provider carries sole responsibility for all and any offers posted on the aforementioned websites and any other websites linked to by Virail , along with any related declarations of intent. Virail does not assume any liability for the accuracy or currency of the information posted by the Provider, particularly where this information is stored on a mobile device.
(2) Any contracts or tickets exist solely between the Provider and the User. Virail is exempt from any contractual regulation, agreement or claim existing between the User and any external booking agent. Bookings shall be governed exclusively by the General Terms and Conditions of the service provider or transport agency, particularly with regard to cancellation and withdrawal. The booking service provider or transport agency remains the sole point of contact for booking and payment processes, as well as any questions relating to that contract. Virail is not able to provide any information on these matters.
(3) The previous paragraphs (1) and (2) remain effective provided that and if Virail captures bookings or booking inquiries or the associated data and information itself, for the purpose of the transmission of a booking or booking inquiry to the provider (e.g. within the scope of express bookings or inquiry forms).
(4) Offers are updated continuously via a technical interface.
(1) The prices indicated in the offer(s) shall be determined by the Provider and communicated to Virail at least once daily.
(2) Offer price is understood to be to the final price for the accommodation, however responsibility for ensuring that prices are appropriate and accurate rests with the Provider. While Virail endeavours to present the total cost of the offer, additional charges may be levied by the Provider’s booking website.
(1) Virail is not liable for the accuracy, quality, completeness, reliability or credibility of Provider created content and/or offers. In particular, Virail does not provide any recommendation or further information regarding the choice of Provider and/or offer.
(2) Virail is not liable for any technical disruption where the cause lies outside of Virail ’s field of responsibility or caused by force majeure.
(3) Virail does not guarantee uninterrupted access to data. Virail retains the right to conduct technical maintenance as required for as long as necessary.
(4) Virail is only liable for damages, regardless of legal basis, caused by deliberate intent and gross negligence. There is no liability for simple negligence except in cases of injury to life, body or health and for claims arising under the Product Liability Act.
(5) Limitations to Virail’s liability also apply to the personal liability of all employees, representatives and agents.
(2) Personal information is only provided, processed and utilized with the consent of the User or where the collection, processing or use of such data is permitted by law.
- Changes to GTC
(1) Virail retains the right to make changes to the GTC with appropriate notice of at least six weeks. In the case of any changes, Virail shall announce the changes on the website, and nominate the date at which the changes are to enter into effect.
(2) Where the User does not reject these changes within six weeks from the announcement date, the amended GTC shall be deemed accepted by the User. Users shall be reminded of this in the Changes to Conditions announcement.
- Final conditions
(1) The laws of the Federal Republic of Germany apply, excluding the UN Convention on the International Sale of Goods (CISG). The place of execution and the court of jurisdiction for all disputes arising from or related to this contract with traders, legal entities under public law or public bodies is Berlin.
(2) Please note that even if our services including these General Terms and Conditions are offered and outlined in English, in any case of any deviation between the English and the German version, the German language version will prevail. The German Version can be found under the following link: www.virail.de/impressum#allgemeine-geschäftsbedingungen
(3) Should one of these General Terms and Conditions become invalid in whole or in part, or unworkable under law, this does not affect the validity of the remainder of the contract.