Last version: December 2024
In accordance with applicable data protection regulations, this Privacy Policy is intended to help you understand what data is collected by MicronNexus GmbH (hereinafter, “CARNECT”) and how it is processed.
The Data Controller for the processing of the personal data you have provided us is CARNECT, with registered office at CS Business Center, 5th Fl, Hohe Bleichen 22, 20354 Hamburg (Germany).
CARNECT will process the personal data collected on this website, as well as via CARNECT profiles on social network, such as Twitter and Instagram. This Privacy Policy applies to any personal data collected via these methods.
CARNECT belongs to a group of companies, referred altogether as HBX Group (hereinafter, “HBX Group”). HBX Group, and therefore, CARNECT has a Global Data Protection Officer to respond to any queries, requests or clarifications regarding the processing of personal data that may be made by CARNECT in the following email address dataprotection@carnect.com or at our postal address, mentioned in the paragraph above.
The personal data processed shall be those that you provide to us through the different forms that CARNECT makes available to you on the website, as well as when you interact or contact us directly or indirectly either through our website, our addresses (emails or postal) or CARNECT or HBX Group profiles on social network.
Also, when you visit CARNECT sites various technologies are used to collect and store information and this includes the use of cookies or similar technologies to identify your browser or device. CARNECT also uses these technologies to collect and store information when you interact with services offered by CARNECT or other features. You can obtain more information about how CARNECT process personal data obtained through cookies or as a result of your browsing in the event that you accept the installation of cookies (for more information about cookies on the Website, visit our Cookie Policy where you can also find details on how to allow or disable cookies).
These purposes are listed below depending on which category of data subject you are, indicating which data shall be processed (type of data) and for what reason or on what basis (legal basis). Likewise, we also process any additional data that you provide us with or that is generated in the course of your relationship with CARNECT for the purposes set out below.
Carry out commercial communications regarding CARNECT's goods and services that are
similar to those that have been the object of the goods and services provided to you. For
example, communications regarding destinations, travel tips, hotels managed by CARNECT.
These communications will be send based on your interests and in line with your profile, as
we inform you in the processing section titled “Automated Decisions and Profiling”.
In this case, the legitimate interest of CARNECT would be to carry out direct marketing
activities aimed at its customers allowed by the data protection and electronic
communications legislations. That is that we can send commercial communications when you
become a customer, in the context of the sale of a product or a service if they are similar
to the products or services that you have purchased. You can object to receive this type of
communications, now or anytime, sending an email to the address identified in section 2.
Likewise, you will have the chance to object in every commercial communication send by
CARNECT by clicking the unsubscribe section included in the footer of each communication.
CARNECT outsources email marketing services in order to compile information on campaigns,
i.e., to track the opening of emails and clicks on content and links included in the emails.
This information is compiled to prepare statistical reports on recipient behaviour so we can
optimise our campaigns.
Preparation of a commercial profile based on your tastes and interests, starting from an
analysis of the products or services you have purchased or shown an interest in and queries
made in order to better match our promotional actions, such as the sending of marketing
messages.
This profile will be prepared from internal sources in accordance with information on your
browsing, the information obtained referring to your requirements or preferences you stated
during your relationship with CARNECT, the activities you effectively engage in and your
different information touchpoints with our organisation. For example, the type of hotel
booked, country of destination or vacation duration, among other aspects.
Conduct surveys and market studies to know the quality of our products or services and the
preference of our clients. The legitimate interest of CARNECT is to improve the commercial
offer and experience to its clients.
Manage and process any legal claims, out-of-court claims and insurance claims received by
CARNECT in relation to you if we carry out a personal data processing that it is not
foreseen by the applicable legislation regarding.
Personal data that you provide to us in your contact by email.
Legitimate interest on answering your question and/or claim. To deal with requests, queries or
complaints through the sections and contact forms on the Website or through other channels such as
email for general information about the Website or call centres.
The processing of your personal data is legitimized by the express consent you give us through the cookie banner made available by CARNECT
You may withdraw your consent at any time in accordance with the information provided in our Cookies Policy.
However, CARNECT processes information obtained through cookies or similar technologies without
your consent when it is necessary to provide you with the website services. Anonymized or
aggregated information that does not contain any attribute that can identify you directly or
indirectly is also processed.
The purpose is:
Those personal data that the privacy policy of the social network in which you have an account /
user profile, as well as the privacy settings you have as a user of that social network allow us
to process. This data depends on your own privacy settings in your account on the social network
and the privacy policy of that social network.
CARNECT has active profiles in different social networks, the following personal data processing
are applicable to persons who become CARNECT stakeholders by being a member, following or being
part of such profiles.
The legal basis for the processing of your personal data is the performance of the terms and
conditions arose from your status as a registered user of the social network:
Those personal data that you provide us and that are generated in the relationship.
Fulfilment of our civil, commercial, tax, accounting and legal obligations related to compliance
with personal data protection regulations, among others that may be applicable.
When legitimate interest is the legal basis for the processing, we ensure that your interests, fundamental
rights and freedoms do not override our legitimate interests which are assessed through a balancing test we
carry out. You can obtain information about the balancing test by contacting CARNECT's DPO, through the
addresses indicated in the “Data Protection Officer” or "How can you exercise your rights" section of this
Privacy Policy.
If you fail to provide certain information that is a statutory or a contractual requirement or a requirement
to enter into a contract, we may not be able to provide the service or information requested by you or enter
into a contract with you, as applicable. We will inform you whenever you are obliged to provide the
information and of the possible consequences of failure to provide such information.
Personal data may be communicated to the following recipients, for the reasons explained below:
| Recipient | Purpose | Legal basis |
|---|---|---|
| Public administrations; Courts and tribunals; Law enforcement agencies | For the fulfilment of the legal obligations to which CARNECT is subject for the development of its activity, and in the cases provided by law, including the obtaining of subsidies and public aid. | Fulfil a legal obligation. |
| Accounting audit firms | To comply with the legal obligations of account auditing to which CARNECT is subject due to its activity. | Fulfil a legal obligation. |
| Companies that are part of HBX Group | We may communicate the data to the other Group companies with the purpose of being able to offer the best service for you taking into consideration your allergies and/or special needs and other administrative purposes. These personal data are considered sensitive and are subject to special protection in accordance with applicable regulations. | The legitimate interest of CARNECT recognized by the applicable regulations on data protection. |
| Third parties interested in acquiring all or part of the capital stock of HBX GROUP. | Analysis and execution of commercial operations in which CARNECT may be involved due to structural modifications or transfer of business. | The legitimate interest of CARNECT to analyse and execute commercial operations in the course of structural modifications or transfers of business. |
In addition, CARNECT has signed confidentiality and processing of personal data agreements necessary and
required by law with suppliers who need access to your data for the provision of services in order to process
the data on our behalf and only under our instructions. Suppliers with whom CARNECT has signed the
aforementioned agreements are those such as call centre provider, customer relationship management systems
providers, marketing service providers, suppliers of internal accounting information management software as
well as banks and other financial institutions.
From CARNECT we shall not share your data with other third parties without first obtaining your consent,
except in those cases where it is necessary for compliance with legal or contractual obligations to which
CARNECT is subject at all times by its nature and activity.
If in the future CARNECT shall make other communications of personal data, it shall inform you in a timely manner.
CARNECT hires the services of suppliers located in countries outside the European Economic Area, the UK and/or Switzerland based on decisions of adequacy of the European Commission, the UK's Secretary of State or the Swiss Federal Council (as applicable). In this case, it is considered that the countries have equivalent
regulations to the European, the UK or the Swiss one. In the event that CARNECT needs to hire services from
suppliers located in countries that do not have regulations equivalent to the European, the UK or the Swiss
(as applicable), the contracting shall include all the guarantees and safeguards required by the regulations
to preserve your privacy, after verification of the legislation of the destination country. In certain
specific cases, we transfer your data outside the European Economic Area, the UK and/or Switzerland because it
is in your interest or is necessary to conclude or perform the contract we have with you. For instance, when
you make a reservation on CARNECT, we might need to transfer your data to a hotel or business partner who is
located in the country of your choice.
Such safeguards may consist of the application of contractual clauses and additional guarantees to them, in
accordance with the regulations of each destination country, or of binding corporate rules approved by the
data protection authorities. For citizens in the European Economic area this contractual clauses are available
here. We also inform you that the regulations allow us to send your data to such
countries, if it is necessary to comply with our obligations arising from the service you request from us.
Likewise, we inform you that HBX, group to which CARNECT belongs, has companies outside the European Union, the UK or Switzerland. A list with these countries can be found here. In those cases, CARNECT requires that these companies comply with the appropriate measures to protect your personal data following the European regulations.
For more information about the guarantees to your privacy, or the destination countries to which we need to
transfer your data to fulfil our contractual obligations to you, you can contact CARNECT, through the
addresses indicated in the "How can you exercise your rights" section of this Privacy Policy.
CARNECT adopts automated decisions regarding your profiling when we make certain uses of your personal data which affects you legally or in a similar fashion.
Automated decisions mean that a decision concerning you is taken automatically based on a computer decision
(leveraging software algorithms) without human review on our part. For example, we tap automated decisions to
customise the sending of marketing communications in line with the responses you supply or your behaviour with CARNECT.
The creation of profiles are based on analysing your interests and are carried out through a general
segmentation, not specific or exhaustive, for example, according to your destination, language, interests
linked to your interactions with CARNECT content, services and products, that is, identifying small aspects of
you as a data subject with information obtained directly from you. This creation of profiles will only
influence the type of commercial communications you will receive from CARNECT.
You may exercise this right by contacting us via the contact details indicated in the “How can you exercise
your Rights” section.
We shall only keep your personal data for as long as we need it for the purposes for which we collect it and
to comply with the statutory limitation and retention periods for reasons strictly limited and authorized by
law or until your consent withdrawal. We retain your personal data a maximum of 10 years which is the
statutory period for the prescription of criminal offenses regarding the noncompliance of tax obligations,
notwithstanding, in certain circumstances, not linked to our contractual relationship, we apply shorter
retention periods. In some circumstances, we anonymize personal data so that it is no longer identifiable, and
we can continue to use it. When we no longer need the personal data, we securely delete or destroy it.
CARNECT retains the data collected to carry out the above purposes for the duration of your relationship with
CARNECT and, even thereafter, until the statute of limitations on any legal liability arising there. For more
information on specific retention periods, you can contact CARNECT through the addresses indicated in the “How can you exercise your rights” section of this Privacy Policy.
You may exercise, with respect to the data collected, the rights of access, rectification, object, deletion,
limitation and portability of data, in accordance with the regulations on data protection and withdraw your
consent, as well as the right to define directives regarding the fate of your data after your death. The
withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
These rights may be exercised by sending a communication:
To the e-mail dataprotection@carnect.com with the subject "Data protection"; or
By any postal means with which there is evidence of receipt by CARNECT, addressed to the following address:
to CS Business Center, 5th Fl, Hohe Bleichen 22, 20354 Hamburg (Germany).
Although the applicable regulation does not introduce any formal requirements for you to exercise your rights.
We recommend including "Data protection" as a subject to the email or the envelope.
Also, if you consider that the processing of your personal data violates the regulations or your privacy rights, you can file a complaint:
CARNECT reserves the right to revise this Privacy Policy at any time it deems appropriate, in order to reflect
regulatory changes, best practices or update the processing activities of personal data and you can see when
this Privacy Policy was last updated at the top of the page. You shall be informed of such updates in
accordance with regulatory requirements, in the event that your rights are significantly affected as a result
of such modification or update.