Privacy Policy

This privacy policy provides you with all relevant information on the processing of your personal data (hereinafter also referred to as “data”) by Blue Casas. The greatest possible transparency is extremely important to us. If you have any questions or comments, please contact us at [email protected].

General Information

Your personal data will be processed in accordance with applicable data protection law. There is neither a contractual nor a legal obligation for you to provide personal data. However, failure to provide such data may mean that we are unable to provide parts of our services in the same form and quality, or at all.

The Scope Of This Privacy Policy

This privacy policy is to inform you about how we process your data when you:
access or use one of our websites,
make use of our services and offers via one of our websites, or in any other way, e.g. by telephone or chat.

The Entity Responsible For Processing Your Data

The entity responsible for processing your personal data within the scope of this privacy policy is:

JP Ventures, LLC dba Blue Casas
215 S. Broadway
STE 1 – 184
Salem, NH 03079

For enquiries please email us at [email protected]

Accuracy

It is important that the data we hold about you is accurate and current, therefore please keep us informed of any changes to your personal data.

What are the categories of data subjects?

Customers, interested parties, visitors and users of the online offer as well as our business partners.

Children Data

Our website is not intended for children and we do not knowingly collect data relating to children. If you become aware that your Child has provided us with Personal Data, without parental consent, please contact us and we take the necessary steps to remove that information from our server.

What are the relevant legal bases for processing your data?

In accordance with Art. 13 GDPR the following informs you about the legal basis of us processing your data and unless the legal basis is not specifically mentioned, the following applies.

Consent – This is where we have asked you to provide explicit permission to process your data for a particular purpose. (Art. 6 Para. 1 lit. a and Art. 7 GDPR)

Contract – This is where we process your information to fulfil a contractual arrangement we have made with you. (Art. 6 Para. 1 lit. b GDPR)

Answering your business enquiries – This is where we process your information to reply to your messages, e-mails, posts, calls, etc. (Art. 6 Para. 1 lit. b GDPR)

Legitimate Interests – This is where we rely on our interests as a reason for processing, generally this is to provide you with the best products and service in the most secure and appropriate way. (Art. 6 Para. 1 lit. f GDPR). Of course, before relying on any of those legitimate interests we balance them against your interests and make sure they are compelling enough and will not cause any unwarranted harm.

Legal Obligation – This is where we have a statutory or other legal obligation to process the information, such as for the investigation of crime. (Art. 6 Para. 1 lit. c GDPR)

Visiting the our website in general

When visiting the Blue Casa website, you transmit data to our web server (due to technical necessity) via your internet browser. The following data is recorded during an ongoing connection for communication between your device browser and our web server:

Date and time of the request;
Name of the requested file;
Page from which the file was requested;
Access status (file transferred, file not found, etc.);
Web browser and operating system used;
Complete IP address of the requesting computer;
Amount of data transferred;

For reasons of technical security, in particular to defend against attempted attacks on our web server, this data is stored by us for a short period of time. It is not possible for us to draw conclusions about individual persons on the basis of this data.
The legal basis for the storage is Article 6 lit. f) GDPR.

The data we collect

Depending on which services you use and how you contact us, the collection and processing of different data is required. The necessary data is collected via online forms, by telephone or by other means exclusively directly from you. The following provides a simple overview about the data we collect depending on your activity on our website:

Account data (Data for the provision of your personal login area as well as data that you store in your login area. Mandatory data are your e-mail address and your password. Further data such as your name, address or a profile picture can be entered voluntary basis.)

Convenience Log In (If you log in with your Facebook or Google account data, we exchange the necessary data with Facebook or Google. As a result, Facebook or Google learn that you are active on Blue Casas and we receive personal profile data from Facebook or Google.

Address data (Street, house number, address additions if applicable, postcode, town, country)

Registration data (Information about the service you have registered for; times and technical information about registration, confirmation ; data provided by you when registering.)

Booking data (Data on products ordered, prices, payment and delivery information. This data is not collected directly from you, but arises in the course of your use of our services.)

Contact details (Telephone number(s), e-mail address(es))

Personal data (Title, form of address/gender, first name, surname and your date of birth.)

Usage data (Information about user behaviour on our website and interaction with our services)

Payment data (Account data, credit card data, data on other payment services).

Access data (Date and time of the visit to our services, the page from which the accessing system accessed our site, pages called up during use, data for session identification (session ID) and the following information of the accessing computer system: Internet protocol address (IP address) used, browser type and version, device type, operating system and similar technical information.)

What we do with your data

We collect and process your data in particular in order to be able to provide you with the services you require.

When you register with us
When you register with us, we process your registration and account data in particular in order to provide you with your personal login area. These data are provided by you when you register on our website and can be changed at any time via your login area. In order for you to access your postings and bookings, we use the data stored in the context of your postings and bookings. It is up to you which data you publish in the context of postings and bookings.

The legal basis for the processing of your data for the purpose of providing a service requested by you is the fulfilment of a contract pursuant to Art. 6 (1) lit. b GDPR. 2.

When you book with us
You can book a variety of holiday services and accommodation as well as additional specific services. If you enquire about a booking, by telephone, email, chat or in any other way, we process the necessary data to be able to provide you with suitable offers. If you book through our website, we collect and process the necessary data for the conclusion of the contract, the implementation of your booking and for the provision of functioning support. This also includes the transfer of your data to the respective providers of the booked services.

The legal basis for processing is the performance of a contract pursuant to Art. 6 (1) lit. b GDPR.

When you book with us
If you contact us in the context of a booking or support enquiry, we occasionally record conversations for training purposes and to improve our service quality. However, a recording is only made if you give us your express consent to do so. Doing so we process, contents of the conversation, in particular personal master data, contact data, address data, payment data and booking data.

If a complaint arises in the course of your booking, we process the necessary data in order to clarify the facts and process the complaint or to support the respective tour operator in clarifying the facts and processing the complaint. As a rule, personal master data, contact data, address data, payment data and booking data are processed. Further data may be stored and processed in individual cases, where applicable, as part of your correspondence with us.

The legal basis for the processing is your consent in accordance with Art. 6 (1) lit. a GDPR. 3.

Customer service
As part of our general customer service, we process enquiries and complaints from holidaymakers, interested parties and hoteliers etc. If you submit an enquiry to us, we process the necessary data to be able to process and answer your enquiry.

If a third party submits an enquiry / complaint, we process the necessary data to clarify the respective facts and to be able to process and answer the enquiry / complaint. If this enquiry concerns content that you have posted on our platform, it may also be necessary to process your data. However, we do not pass on your data to a third party without an appropriate legal basis. The processing operations and data required depend on the specific requirements of the individual case.

The legal basis for the processing is our legitimate interests pursuant to Art. 6 (1) lit. f GDPR, whereby our legitimate interests lie in the provision of a functioning customer service, the processing of enquiries, the handling and defence of complaints and ensuring the fulfilment of the rights of the data subjects.

To prevent fraud and to protect against the misuse of our services
We process the necessary data to prevent fraud, to clarify suspected cases of fraud and to protect our website/services from misuse. To do this, we use special technologies that detect and report irregularities.

To prevent misuse of our website and to protect against fraudulent activities, for example by automated bots, we use reCAPTCHA, a captcha service from Google (Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA), in individual areas of our website. reCAPTCHA collects data to determine whether a user is a natural person or a bot, for example. The analysis is carried out by Google. Blue Casas has no access to the data collected by reCAPTCHA.

The legal basis for the processing is our legitimate interests pursuant to Art. 6 (f) of the GDPR, whereby our legitimate interests lie in the prevention and clarification of cases of fraud as well as in the protection of our websites against misuse.

To develop and improve our services and processes
We are constantly working to improve existing services and develop new ones. In this context, we process the necessary data to find out how our services are used by our customers. The aim of the processing is not to analyse the behaviour of individuals or to create a profile, but to analyse the use of our services by the totality or large groups of our customers. Accordingly, your data will be combined / aggregated with the data of other customers in a first step. In the following, the analyses will only take place on the basis of aggregated/anonymised data.

The legal basis for the processing is our legitimate interests pursuant to Art. 6 (f) of the GDPR, whereby our legitimate interests lie in the further development and improvement of our existing services, the development of new services and the creation of evaluations and reports.

Improvement and development of internal processes
We process the necessary data to continuously improve our systems and internal processes. At no time is the processing of information about your person in the foreground; accordingly, we pseudonymise or anonymise your data as far as this is possible in the respective case.

The legal basis for the processing is our legitimate interests pursuant to Art. 6 (f) of the GDPR, whereby our legitimate interests lie in the improvement and development of internal processes.

Development of new and improvement of existing technologies
We process the necessary data as part of the development of new technologies and the improvement of existing technologies in order to improve our services and set new standards in the area of data protection and information security. This includes in particular the areas of machine learning, artificial intelligence and deep learning. In doing so, we only use pseudonymised, anonymised or aggregated data as far as technically possible.

The legal basis for the processing is our legitimate interests pursuant to Art. 6 (f) of the GDPR, whereby our legitimate interests lie in the development of new technologies and the improvement of existing technologies.

To send you newsletters and other information
We send newsletters and other notifications with promotional information based on your consent or our legitimate interests. This does not include messages without promotional information sent as part of our contractual or other business relationship with our customers. If you use our services, we process the necessary data to send you advertising about our own similar services (direct advertising). The advertising content is not personalised.

You can object to this use of your data at any time with effect for the future. To do so, simply send us an email. In this case, we will process your data to document your objection in our system.

The legal basis for the processing is our legitimate interests pursuant to Art. 6 (1) lit. f GDPR, whereby our legitimate interests lie in initiating business and increasing sales.

Newsletter / personalised advertising
When you register to receive our newsletter and other promotional information, we process the necessary data to request confirmation of registration (so-called double opt-in procedure) and to document the registration. If you confirm your registration to receive our newsletter and other promotional information, we process the necessary data to carry out the mailing and to adapt the content to your interests. This includes, for example, reminders about unfinished processes and the sending of surveys on customer satisfaction or the use of our services. Your registration and its confirmation constitute consent within the meaning of the GDPR.

You can revoke your consent at any time. The revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation. To do so, simply send an informal e-mail to [email protected]. In this case, we will process your data to document your revocation in our system.

The legal basis for the processing is your consent pursuant to Art. 6 (1) lit. a GDPR.

Messenger services
If you contact us via messenger on the website, we process the necessary data to document your registration and to send messages. Your use of the messenger constitutes consent within the meaning of the GDPR. You can revoke your consent at any time. The revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.

The legal basis for the processing is your consent pursuant to Art. 6 (1) lit. a GDPR.

Tracking when you access or use our web site
When you access/use one of our website, we collect and process the necessary data, in particular via cookies, in order to ensure and optimise the functionality of our website, to find out how customers and interested parties use our website and to adapt our website and content to your presumed interests. We pass on the collected data to our partners and tracking service providers as far as necessary for the respective purposes.

The data collected and processed when you use our website is not assigned to a natural person, but is processed exclusively in pseudonymised form using cookie IDs or other identifiers. A link with other data, for example with your booking data, is only made after and on the basis of your explicit consent.

Further information can be found in our Cookie Policy.

Reach measurement; statistical analyses, optimisation of the website
We process the necessary data to analyse how the entirety and/or large groups of our customers and interested parties use our website. This is necessary to create internal evaluations and reports, to adapt our web offer and to ensure an optimal user experience at all times. In this context, we process data on how you access our website as well as data on how you interact with our website and services.

The processing of your data in connection with the use of tracking technologies is based on various legal bases.
Insofar as data processing takes place in order to be able to provide you with a service you have requested, this is based on Art. 6 (1) (b) GDPR. Insofar as the data processing is carried out in order to ensure the functionality of our website, to optimise our services, to determine characteristics about the use of the website and to enable correct commission accounting, this is based on our legitimate interests according to Art. 6 para. 1 lit. f GDPR.
Insofar as data processing is carried out in order to be able to show you optimised and personalised advertising and content, this is based on your prior consent in accordance with Art. 6 (1) lit. a GDPR.

Your consent

You have the option at any time to consent in whole or in part to the processing of your data for the aforementioned purposes or to revoke a previously given consent and to object to the processing of your data. To do so, simply use the link to the privacy settings in the footer. The withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the withdrawal.

When and how we transmit data

We may share your information with organisations that help us provide the services described in this policy and who may process such data on our behalf and in accordance with this policy, to support our online offer and our services.

In the course of providing its services, Blue Casas also uses external service providers, such as hosting and software service providers, payment service providers or service providers in the course of booking travel or sending information and documents. In this context, data is only processed for the purposes of, in accordance with the instructions of and under the control of Blue Casas.

In the course of carrying out bookings, it is necessary to transfer your data to tour operators and other providers of the booked services, or corresponding intermediaries. These are not service providers of Blue Casas but process your data as independent data controllers in accordance with Art. 4 No. 7 GDPR.

If we are obliged to do so on the basis of a law or other regulation or the decision of an authority or court, we will pass on data to the necessary extent to authorities or other third parties.

Transmission to third countries

Data is only transferred to third countries within the scope of and in compliance with the strict conditions of permissibility set out in Articles 44 – 49 of the GDPR. Accordingly, a transfer only takes place on the basis of an adequacy decision of the EU Commission or we ensure an adequate level of data protection with the help of the EU standard data protection clauses.

If you book a trip or other service to be provided by a provider based in a third country, we cannot guarantee an adequate level of data protection in every case. In this case, the transfer of data to carry out the booking is based on Art. 49 (1) lit. b GDPR.

How long we store data

In General
We do not store data for longer than is necessary for the respective processing purposes. If the data is no longer required, it is regularly deleted unless there is an obligation to retain it. Such obligations may arise, for example, from commercial and tax law or in the context of legal disputes.

Registration / Login area
We store data that you enter in your login area during registration or in the following until you change or delete it in your login area or until you delete your login area yourself.

Booking
We store data that we collect in connection with the preparation of an offer for a period of 3 years. We store data that we collect in connection with your booking for a period of 10 years. Payment data is deleted after 72 hours at the latest. The data is stored for verification purposes and to fulfil Blue Casas’s legal obligations.

Customer service / complaints
We store data that we collect and process in the context of communication with you for a maximum of 3 years, provided there is no reference to a booking or complaint. We store data that we collect and process in the context of handling complaints or other procedures for 4 years after the conclusion of the procedure in accordance with the legal requirements.

Online presences in social media

We maintain online presences on Facebook and Instagram on the basis of our legitimate interests within the meaning of Article 6 lit. f) GDPR and in order to communicate with customers, interested parties and users who are active there. Unless otherwise stated in this policy, we process the data of users if they communicate with us within the social networks and platforms, e.g. write articles on our online presences or send us messages.

Social Media Functions and Widgets

Within our online offer, functions and widgets of Facebook and Instagram are integrated. When you click on or use any of those functions and widgets, your browser establishes a direct connection to Facebook and Instagram. The function or widget then transmits log data to Facebook and Instagram. This log data may contain your IP address, the address of the visited websites, type and settings of the browser, date and time of the request, your usage of Facebook and Instagram, as well as cookies. Those may also include the display of our post, the link to our profile, the possibility to interact with the posts and functions, as well as to measure users reach (so-called conversion measurement).

Online Payment, Secure data transmission and Credit card information

The transmission of your personal information during an order transaction is encrypted using industry standard Secure Socket Layer (“SSL”) technology, (SSL encryption version 3). Any credit card information you provide will not be stored by us, but will be encrypted and collected directly from our payment service providers Stripe and PayPal via hypertext transfer protocol secure (“https”).

We may share information with Stripe and PayPal , and you may need to provide credit or debit card information directly to the provider in order to process payment details and authorise payment following a secure link. The information which you supply to in such cases is not within our control and is subject to Stripe and PayPal’s own Privacy Notice and Terms and Conditions.

Applications

If you use our forms to apply for a role or job, we process the information we receive from you as part of the application process, e.g. through your letter of application, CV, references, correspondence, telephone or verbal details. In addition to your contact details, information about your education, qualifications, work experience and skills is particularly relevant to us.

Your data will initially be processed solely for the purpose of carrying out the application process. If your application is successful, it will become part of your personnel file and will be used to carry out and terminate your employment and will be deleted in accordance with the rules applicable to personnel files. If we are unable to offer you employment, we will continue to process your data for up to six months after sending the rejection in order to defend ourselves against any legal claims, in particular alleged discrimination in the application process.

The legal basis for processing data during the application process is Art. 6 (1) b GDPR and, if you have given your consent, for example by sending us information that is not necessary for the application process, it is Art. 6 (1) a GDPR. The legal basis for data processing after a rejection is Art. 6 1 letter f GDPR.

As a rule, we do not require any special categories of personal data within the meaning of Art. 9 GDPR for the application process. We ask you not to provide us with any such information from the outset. If such information is relevant to the application process, we process it together with your other data. Your data will not be used by us for automated decision-making or profiling, nor will it be passed on to third parties. Your data will be processed by us or on our behalf.

You are not obliged to provide us with personal data. However, we can only assess your suitability for the respective position under consideration if we receive information in particular about your education, work experience and skills, and we cannot include you in the application process without providing your contact details.

Integration Of Services And Contents Of Third Parties

We use within our online offer on the basis of our legitimate interests (Art. 6 para. 1 lit. f. GDPR), content or services offered by third-party providers in order to integrate their content and services.

This always requires that the third-party providers of this content are aware of your IP address, since the content or service could not send to your browser without the IP address. The IP address is thus required for the display of this content and we endeavour to use providers that only use your IP address for the delivery of the content or services. However, Third-party providers may also use so-called pixel tags (invisible graphics, also known as “web beacons”) for statistical or marketing purposes. The “pixel tags” can be used to evaluate information such as visitor traffic on the pages of this website. The pseudonymous information may also be stored in cookies on the user’s device and may contain, among other things, technical information about the browser and operating system, referring websites, time of visit and other information about the use of our online offer, as well as be linked to such information from other sources.

Your Rights

You have a number of ‘Data Subject Rights’ below is some information on what they are and how you can exercise them.

Right to information: You can request information from us as to whether and to what extent we process your data.

Right to rectification: If we process your data that is incomplete or incorrect, you can request that we correct or complete it at any time.

Right to erasure: You may request that we erase your data if we are processing it unlawfully or if the processing disproportionately interferes with your legitimate interests in protection. Please note that there may be reasons that prevent immediate deletion, e.g. in the case of legally regulated retention obligations. Irrespective of the exercise of your right to deletion, we will delete your data immediately and completely, insofar as there is no legal or statutory obligation to retain data in this respect.

Right to restriction of processing: You may request us to restrict the processing of your data if you dispute the accuracy of the data for a period of time that allows us to verify the accuracy of the data, the processing of the data is unlawful, but you object to erasure and request restriction of data use instead, we no longer need the data for the intended purpose, but you still need this data to assert or defend legal claims, or
you have objected to the processing of the data.

Right to data portability: You may request that we provide you with the data you have provided to us in a structured, commonly used and machine-readable format and that you may transfer this data to another controller without hindrance from us, provided that we process this data on the basis of a revocable consent given by you or for the performance of a contract between us, and this processing is carried out with the aid of automated procedures. If technically feasible, you may request us to transfer your data directly to another controller.

Right to object: If we process your data for legitimate interest, you may object to this data processing at any time; this would also apply to profiling based on these provisions. We will then no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is for the assertion, exercise or defence of legal claims. You may object to the processing of your data for the purpose of direct marketing at any time without giving reasons.

Right of complaint: If you are of the opinion that we violate data protection law when processing your data, please contact us so that we can clarify any questions. Of course, you also have the right to contact the supervisory authority responsible for you, the respective state office for data protection supervision. If you wish to assert any of the aforementioned rights against us, please contact us. In case of doubt, we may request additional information to confirm your identity.

Where the processing of your personal information is based on consent, you have the right to withdraw that consent without detriment at any time.

The above rights may be limited in some circumstances, for example, if fulfilling your request would reveal personal information about another person, if you ask us to delete information which we are required to have by law, or if we have compelling legitimate interests to keep it. We will let you know if that is the case and will then only use your information for these purposes. You may also be unable to continue using our services if you want us to stop processing your personal information.

We encourage you to get in touch if you have any concerns with how we collect or use your personal information.

Automated decision-making and profiling
We do not use automation for decision-making and profiling.

Do Not Sell My Personal Information
We do not sell information that directly identifies you, like your name, address or phone records.

Hosting
The services for hosting and displaying the website are partly provided by our service providers as part of processing on our behalf. Unless otherwise explained in this privacy policy, all access data and all data collected in forms provided for this purpose on this website are processed on their servers. If you have any questions about our service providers and the basis of our relationship with them, please contact them as described in this privacy policy.

Content Delivery Network
For the purpose of a shorter loading time, we use a so-called Content Delivery Network (“CDN”) for some offers. With this service, content, e.g. large media files, are delivered via regionally distributed servers of external CDN service providers. Therefore, access data is processed on the servers of the service providers. Our service providers work for us within the framework of order processing. If you have any questions about our service providers and the basis of our cooperation with them, please use the contact option described in this privacy policy.

Changes
This policy and our commitment to protecting the privacy of your personal data can result in changes to this policy . Please regularly review this policy to keep up to date with any changes.

Queries and Complaints
Any comments or queries on this policy should be directed to us. If you believe that we have not complied with this policy or acted otherwise than in accordance with data protection law, then you should notify us.