Privacy Policy

Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Crystal Collegium Travel GmbH
Lindwurmstraße 80, 80337 München, Germany
Phone +49 89 37954830 · Fax +49 89 37954839
Email info@crystal-tours.de
Commercial register: Amtsgericht München (Munich Local Court), HRB 184122
VAT ID DE269222549
Managing directors: Marco Lucarelli, Roberto Lucarelli, Nadja Zakaria

For questions about data protection, you can reach us at datenschutz@crystal-tours.de.

Scope of this policy

This policy applies to the website omana-festival.com and to the ticket and programme functions provided at app.omana-festival.com. Our other websites, portals and apps are covered by the policies published there; for our social media profiles, the terms of the respective provider apply in addition.

Principles

We process personal data only to the extent necessary for the purposes stated in each case, and only for as long as necessary for these purposes or required by statutory retention obligations. Your data is not used for any purposes other than those stated here.

Visiting this website and server logs

When you visit this website, your browser transmits technically necessary data, which we store in server log files: IP address, date and time of access, the address requested, the amount of data transferred, a message on whether the request succeeded, browser type and version, operating system and, where applicable, the page visited before. This data is used to deliver the website, to keep it operating securely and to fend off abusive access. It is not combined with other data or analysed for advertising purposes.

We store these logs to detect and investigate attacks, abuse and technical faults; such incidents are often noticed only after some time. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and uninterrupted operation of this website. The logs are deleted after 30 days at the latest.

This website is hosted by the following provider: netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany; the servers are located in Germany. We have a data processing agreement with this provider under Art. 28 GDPR.

Storage on your device (cookies and similar technologies)

Information is stored on or read from your device only where this is strictly necessary for the service you have requested, or where you have given your consent. You can withdraw any consent at any time with effect for the future. In detail:

Consent and proof of consent

Where we need your consent for processing, we ask you for it before the processing begins. We store your decision, whether you accept or decline, in the cookie ct_consent for 365 days so that we don't ask you again on every visit. This cookie is necessary to implement your decision (Section 25(2) no. 2 TDDDG).

To prove consent (Art. 7(1) GDPR), we also record: the time of the decision, the categories selected, the version of the consent text, the language, the browser identifier, and your IP address in pseudonymised form (as an HMAC value). We do not store the IP address itself. We keep this proof for 36 months and use it solely to be able to demonstrate, in the event of a dispute, whether and how consent was given. The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR.

You can change or withdraw your decision at any time via "Privacy settings". Withdrawing is as easy as giving consent; withdrawn consent takes effect immediately for the future.

Statistics with your consent

If you have consented, we analyse your use of this website statistically in order to improve it. For this, we set the cookie ct_sid from our own server. It contains a random session identifier that lets us see which pages are visited within one visit. It lasts for up to 12 months; if you withdraw your consent, the cookie is deleted immediately. Without your consent, ct_sid is not set.

The analysis takes place on our own analytics system. The data is not passed on to third parties and is not transferred to countries outside the European Union. Only aggregated results are analysed; results based on fewer than five cases are not output.

The legal basis is Section 25(1) TDDDG and Art. 6(1)(a) GDPR. You can withdraw your consent at any time via "Privacy settings" with effect for the future.

Individual events are stored for 14 months; aggregated results without any personal reference are kept beyond that.

Booking

For your booking, we process master, contract and travel data: name, date of birth, address, contact details, details of the services booked, payment data and any requests you tell us. The purpose is to conclude and perform the contract, including booking with the service providers, billing and meeting legal obligations. The legal basis is Art. 6(1)(b) GDPR, and for retention Art. 6(1)(c) GDPR.

Automatic age check

Our trips are intended for adults. During booking we therefore automatically check, based on the date of birth provided, whether each traveller will be at least 18 years old on the day of arrival. If not, the booking cannot be completed online. This check is necessary for entering into the contract (Art. 22(2)(a) GDPR). If you believe the result is wrong, write to us at booking@omana-festival.com: a member of staff will review the case personally, and you can state your point of view.

Recipients: our own booking system; the service providers involved in the trip, where this is necessary to carry it out, in particular accommodation providers, transport companies, local agencies and event partners at the destination; authorities, where we are legally obliged to transfer data. For trips outside the EU/EEA, data is transferred under Art. 49(1)(b) GDPR where this is necessary to perform the contract.

Confirmation: You receive the booking confirmation with the contract documents by email; internally, the staff responsible for carrying out the trip receive a copy.

We also analyse bookings internally for statistical purposes to plan our sales, for example which accommodation and extras are booked and how you found us. For this we use records without names or contact details, which only we can link to a booking via an identifier. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is planning and managing our offer. We delete these records after 14 months or merge them into totals.

Storage period: until the statutory retention periods (Section 257 HGB, Section 147 AO) and the limitation periods for claims under the contract have expired.

Contact form

Through our contact form, we process the details you enter (name, email address, message) to handle your request. Mandatory fields are marked. The legal basis is Art. 6(1)(b) GDPR for contract-related enquiries, otherwise Art. 6(1)(f) GDPR. Your message is forwarded to our mailbox info@omana-festival.com; no external service provider is involved.

We only count how many enquiries reach us through this form each day, broken down by language and by how you came to our website (for example a search engine, a social network or directly). The content of your enquiry and your contact details are not part of this count. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is planning our offer.

To protect against automated submissions, we process technical characteristics of the submission, including your IP address in pseudonymised form (as an HMAC value), to limit how often submissions can be sent. This data is stored for no more than 24 hours and is not combined with other data. The legal basis is Art. 6(1)(f) GDPR.

We delete your message once your request has been fully handled, unless statutory retention obligations prevent this.

Presale code

If you have redeemed a presale code, we store this in the cookie ct_entrance for 30 days as an HMAC value. This lets us recognise, when you book later, that you are entitled to presale access, without asking for the code again. The cookie contains no information about you as a person. The legal basis is Art. 6(1)(b) GDPR in conjunction with Section 25(2) no. 2 TDDDG; the storage is necessary to give you the access you have requested.

Newsletter

To send the newsletter, we process your email address and your first name, if you provided it; we use your first name only to address you personally. Sign-up uses a confirmation procedure: after you sign up, you receive an email with a confirmation link; only after you confirm do we add you to the mailing list. The confirmation link is valid for 72 hours; if you don't confirm, we delete your details. We send the confirmation email and the newsletter via our own mail server. It is operated in a data centre in Germany; we have a data processing agreement with the operator (Art. 28 GDPR). No data is transferred to third countries.

To prove your consent, we record sign-up, confirmation and unsubscription with the time, the text version and your IP address in pseudonymised form (as an HMAC value), and we keep this proof for 36 months after your subscription ends (Art. 7(1) GDPR).

The legal basis for sending is Art. 6(1)(a) GDPR. You can unsubscribe at any time, via the link in every email or by sending us a message. After that we will no longer send you our newsletter and will remove you from the mailing list. So that we do not contact you again by mistake, we keep your email address and the time you unsubscribed on a blocking list that we use for this purpose only. Details we hold from a booking you made are not affected; we continue to process them to handle your trip and to meet statutory retention periods.

For each mailing we record which mailing went to which recipient — the recipient not in plain text but in pseudonymised form (as an HMAC value) — so that nobody receives a mailing twice and so that we can prove that it was sent. We delete this record 36 months after sending; unsubscribing stops future mailings but does not remove this record. The legal basis is our legitimate interest in sending mailings properly and in being able to provide evidence in the event of a dispute (Art. 6(1)(f) GDPR).

Evaluation of our newsletter

The evaluation described below is not yet in operation. We will only start it once this notice has been updated accordingly; until then we do not evaluate anything on a per-person basis. Consent you give now applies from that point.

If you also consented to the evaluation when signing up, we evaluate whether you open our newsletter, which links in it you click and whether you then book with us. For this purpose each evaluated email contains an invisible image (tracking pixel) that is retrieved from our server when images are loaded; its links first lead via our server and then forward you to their destination. For each open or click we store the mailing, the language, the time, for a click the link destination, and an identifier derived from your email address. This identifier is pseudonymous: we can attribute it to your address. To determine how many bookings follow a mailing, we briefly match this information against our booking data and store only totals per mailing.

The purpose is to improve our newsletter and to measure its success. The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). You can withdraw it at any time via the "Stop evaluation" link in every evaluated email or by writing to datenschutz@crystal-tours.de, without unsubscribing from the newsletter. You can also prevent open counting by switching off image loading in your email program.

We delete individual opens and clicks six months after the respective mailing was sent, and immediately if you withdraw the evaluation or unsubscribe from the newsletter. We keep the totals per mailing without reference to any person.

Ticket and entry

After your booking, we provide your ticket at a personal address, which we send to you by email. When the ticket page is opened, we process the code it contains and the details belonging to the booking (name, service booked, validity). At entry, the ticket is scanned; we store the time and result of the scan to prevent multiple entries and to keep entry traceable.

If you pay cashless on site, we process the related transactions for billing.

The legal basis is Art. 6(1)(b) GDPR, and for the scan logs Art. 6(1)(f) GDPR (preventing misuse). The ticket page sets no cookies and embeds no third-party content.

We delete scan logs 3 months after the end of the event, unless billing obligations prevent this.

We delete the ticket and guest data stored in the ticket application three months after the end of the event, and the logs of ticket emails sent after 90 days. The contract and billing data belonging to your booking are not affected and are subject to the statutory retention periods.

Contacting us

If you contact us by email, phone or fax, we process your details to handle your request.

Legal basis: Art. 6(1)(b) GDPR where your request concerns a contract with us or is aimed at concluding one; otherwise Art. 6(1)(f) GDPR (our interest in answering enquiries).

Storage period: until your request has been fully handled, then until statutory retention periods expire (see the section "Storage period and retention obligations").

Our social media profiles

We link to our profiles on social networks. These links are simple references; no data is transmitted to the networks when you visit our website. Only when you click a link do the privacy terms of the respective provider apply.

Recipients

Within our company, only those departments that need access to fulfil the stated purposes receive it. Beyond that, we pass data to service providers we use who act for us as processors under Art. 28 GDPR, and to bodies to which we must transfer data because of a legal obligation or to perform a contract. The recipients concerned are named for each processing activity.

Transfers to third countries

Where data is transferred to countries outside the European Union and the European Economic Area, this happens only if the requirements of Art. 44 et seq. GDPR are met: on the basis of an adequacy decision of the European Commission under Art. 45 GDPR, otherwise on the basis of the European Commission's standard contractual clauses under Art. 46(2)(c) GDPR together with supplementary safeguards, or on the basis of your explicit consent under Art. 49(1)(a) GDPR. The applicable basis is stated for each processing activity. You can obtain a copy of the standard contractual clauses on request at datenschutz@crystal-tours.de.

Storage period and retention obligations

We delete personal data as soon as the purpose of the processing no longer applies. We keep contract and billing data beyond that where commercial and tax retention obligations require it (Section 257 HGB – German Commercial Code, Section 147 AO – German Fiscal Code); during this time, the data is blocked for any other purpose. Specific periods are stated for each processing activity.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw any consent at any time with effect for the future (Art. 7(3) GDPR); this does not affect the lawfulness of processing carried out before the withdrawal. Please contact datenschutz@crystal-tours.de.

In addition, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany.

Right to object

Right to object: Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object at any time on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. If your data is processed for direct marketing, you can object at any time without giving reasons; the data will then no longer be processed for this purpose.

Whether you must provide data

Where providing data is necessary to conclude or perform a contract, this is marked when the data is collected. Without this data, we cannot conclude or perform the contract. Otherwise, providing data is voluntary.

No automated decision-making

Automated decision-making, including profiling, within the meaning of Art. 22 GDPR does not take place, unless expressly described otherwise in this policy.

Data security

Data is transmitted in encrypted form via TLS. We take technical and organisational measures under Art. 32 GDPR to protect your data against loss, destruction, manipulation and unauthorised access; our measures are continuously adapted to the state of the art.

Minors

Participation requires a minimum age of 18 on the day of arrival. Bookings from persons who do not meet this age are not accepted; for this purpose, we process the date of birth provided. The legal basis is Art. 6(1)(b) GDPR.

Changes to this policy

We update this policy when the processing described changes. The version published here applies. Last updated: 14.10.2026 · Version DSE-EN-2026.1 (reading version of DSE-DE-2026.13).