Privacy notice

Controllers

The following companies are joint controllers for the processing of your data on amarufiles.com:

Joint controllership and allocation of responsibilities

The three companies named above run this campaign together and on an equal footing and have entered into an arrangement under Article 26 GDPR and Article 26 UK GDPR. Its essence: each company is responsible for the participants resident in its country, answers their requests concerning data subject rights and cooperates with the supervisory authority there: Next Level Erlebnisse GmbH for Germany and Austria, VR Entertainment Ltd for the United Kingdom, VR Entertainment (Ireland) Ltd for Ireland. The three companies decide jointly on the purposes and means of the processing. Next Level Erlebnisse GmbH operates the website, the database and the email service on behalf of all three and conducts the draw; your data is stored only there.

You may exercise your rights against any of the three companies, irrespective of this allocation. Your point of contact is the company named for your country: service@nextlevel-erlebnisse.de for Germany and Austria, reporting@vregroup.co.uk for the United Kingdom, reporting@vregroup.co.uk for Ireland. If you are unsure which one is responsible, write to service@nextlevel-erlebnisse.de and we will forward your request internally.

We will provide the essence of the arrangement on request.

Data protection officer

No data protection officer is appointed as a legal requirement. For any data protection question, contact service@nextlevel-erlebnisse.de.

Registering for the campaign

When you register we process your email address, the venue you chose, your language, the time of your consent, the version of the terms of participation and of this notice that you accepted, and a randomly generated, non-guessable referral code.

The legal basis is Article 6(1)(b) GDPR: the processing is necessary to perform the participation relationship that your registration establishes.

Your registration only takes effect once you click the link in our confirmation email (double opt-in). We store the time of confirmation. If you do not confirm, we delete the unconfirmed registration no later than 30 days after it was received.

To evidence your consent we also store a keyed hash of your IP address and a shortened note of your browser. The hash cannot be turned back into an IP address. The legal basis is Article 6(1)(f) GDPR, our legitimate interest in being able to demonstrate consent.

Prize entries and determining the winner

We record which entries you have earned: one for your confirmed registration, one for each person who registered and confirmed through your personal invitation link, and one for a social media post we have reviewed. For each entry we store the time and the reason it was awarded.

To determine the winner we freeze the pool of entries at the moment of the draw and log the draw so that it can be verified. The legal basis is Art. 6(1)(b) GDPR.

If you win, we process further data to arrange the prize, for the trip in particular the names, dates of birth, address and the identity document details of the travellers needed for the booking. We pass this data to the tour operator carrying out the trip. The legal basis is Art. 6(1)(b) GDPR. Without this data the trip cannot be booked.

Invitation link

Your personal invitation link contains a random code, not your email address. When another person takes part through your link and confirms their email address, we store the connection between the two registrations in order to award your entry. The invited person does not see who invited them; you only see the number of confirmed invitations, not the addresses.

We do not learn whom you sent your link to, and we do not send emails to third parties through your link. If you share the link, you are the one passing it on. Please share it only with people who are happy to receive it.

The legal basis is Art. 6(1)(b) GDPR.

Social media post

When you submit the link to a post, we store that link, the platform, the time of submission and the result and time of our review. A member of staff opens the post on the platform to check whether it meets the requirements of the terms of participation. In doing so we see your public profile and the public post in the same way as anyone else on the platform. We do not download the post and do not keep a copy.

The post is opened through the respective platform (Instagram or Facebook: Meta Platforms Ireland Limited; TikTok: TikTok Technology Limited, Dublin; YouTube: Google Ireland Limited). The platform's own privacy notice applies to its processing; we do not transmit any data from your registration to the platform.

The legal basis is Art. 6(1)(b) GDPR. Submitting a post is voluntary; without it you only forgo this one entry.

Campaign email

We send you the confirmation email, your personal booking link for the premiere, and messages necessary for your participation. The legal basis is Article 6(1)(b) GDPR.

You will only receive promotional email about Sandbox VR if you additionally and voluntarily opted in during registration. The legal basis is Article 6(1)(a) GDPR. You can withdraw that consent at any time, through the unsubscribe link in every promotional email or by writing to service@nextlevel-erlebnisse.de. Withdrawal does not affect the lawfulness of processing carried out beforehand.

Taking part in the prize draw does not depend on the marketing consent. Anyone who does not opt in has exactly the same chances.

Server log files

When you open this website the web server automatically records the IP address, date and time, the address requested, the volume of data transferred, the browser type and the operating system. This data is technically necessary to operate the site.

The legal basis is Article 6(1)(f) GDPR, our legitimate interest in secure and uninterrupted operation. Log data is deleted after 30 days at the latest.

Strictly necessary cookies

We set a session identifier so that your confirmed participation is recognised again (amaru_sess, 30 days), we store your language choice, and we store your decision on analytics and marketing services in a cookie (amaru_consent, 180 days). All three are necessary for the function you requested and need no consent.

Analytics and marketing services, only with your consent

On your first visit we ask whether we may use services for audience measurement and advertising. Until you consent, none of these services is loaded and nothing is transferred to Google or Meta. You can change or withdraw your choice at any time via the "Cookie settings" link at the bottom of the page.

The legal basis is your consent, Article 6(1)(a) GDPR and, in the United Kingdom, regulation 6 PECR. Withdrawal does not affect the lawfulness of processing carried out beforehand.

Google Tag Manager: we use Google Tag Manager from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to load the services listed below. The tag manager itself is only loaded after you consent. We pass your consent decision to Google (Consent Mode) so that the services honour it.

Google Analytics 4 (statistics): audience measurement with truncated IP address. Google also processes the data in the United States; the basis is the certification of Google LLC under the EU-US Data Privacy Framework and the UK Extension to it. Google retains event data for 14 months.

Google Ads (marketing): conversion measurement and remarketing, also Google Ireland Limited, with transfer to the United States on the same basis.

Meta Pixel (marketing): conversion measurement and audience building, Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. Meta is certified under the EU-US Data Privacy Framework. When the pixel is used we are joint controllers with Meta within the meaning of Article 26 GDPR; the arrangement is available at https://www.facebook.com/legal/controller_addendum.

We do not pass email addresses, solutions or any other registration details to these services. Only technical events such as "registration submitted" are transmitted.

Hosting

This website is hosted by Host Europe GmbH, Hansestraße 111, 51149 Cologne, Germany. The host processes the server log data and the stored campaign data on our behalf in a data centre in the European Union under a data processing agreement pursuant to Article 28 GDPR. The legal basis is Article 6(1)(f) GDPR, our legitimate interest in secure and efficient operation.

Recipients

Your data is received by: the host of this website, our email service provider for campaign email (Brevo, Sendinblue SAS, 7 rue de Madrid, 75008 Paris, France; processing in the EU, the provider sees the recipient address, subject and delivery status), if you win the trip the tour operator carrying it out, and, only after your consent, the providers named in the section on analytics and marketing services.

Data processing agreements are in place with all providers. Transfers outside the EU and the United Kingdom only take place where an adequacy decision or standard contractual clauses apply. The transfer to the British company relies on the European Commission adequacy decision for the United Kingdom.

Booking the trip to Peru requires a transfer to service providers in Peru. That transfer is made under Article 49(1)(b) GDPR because it is necessary to perform the contract with you.

Retention

Unconfirmed registrations: 30 days.

Confirmed participations, prize entries and consent records: until the campaign and prize fulfilment are complete, then until the statutory limitation and retention periods expire.

Data used to deliver a prize: for the periods required by tax and commercial law, as a rule up to ten years.

Submitted post links and the review result: until the campaign and the prize handling are complete.

Logs of solution attempts: 90 days.

Confirmation and booking tokens are stored only as hashes and deleted once they expire.

If you consented to marketing, we process your address for that purpose until you withdraw. After a withdrawal or an erasure we keep a hash of your address so that you are not contacted again.

Your rights

You have the right of access (Article 15), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and objection to processing based on a legitimate interest (Article 21). You may withdraw any consent at any time.

Write to service@nextlevel-erlebnisse.de. Erasing your participation ends that participation; entries already awarded lapse with it.

You also have the right to lodge a complaint with a supervisory authority. Ours is the Hessian Commissioner for Data Protection and Freedom of Information, Postfach 3163, 65021 Wiesbaden, Germany. You may also contact the authority in your country of residence: in the United Kingdom the Information Commissioner's Office, in Ireland the Data Protection Commission.

No automated decision-making

Entries are awarded according to fixed rules published in the terms of participation. There is no profiling and no automated decision with legal effect within the meaning of Article 22 GDPR. The draw itself is a random procedure, not an assessment of you.

Obligation to provide data

Your email address, a venue and acceptance of the terms of participation are required in order to take part. Without them participation is not possible. Everything else is voluntary.

Changes to this notice

We update this notice when the processing changes. Each version carries a version identifier. The version you accepted is stored with your registration.