Privacy Policy

Controller

We are not obliged to appoint a data protection officer (Art. 37 GDPR). If you have any questions about data protection, please contact us directly at the email address above.

Collection and storage of personal data when visiting the website

When you visit our website, your browser automatically sends the following data to our server (server log files):

• IP address of the requesting computer
• Date and time of access
• Name and URL of the file accessed
• Website from which access is made (referrer URL)
• Browser used and, where applicable, operating system

The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in ensuring the smooth operation of the website). The data is deleted after 7 days.

Contact form

When you use our contact form, we collect the following data:

• Name
• Email address
• Your message

The legal basis is Art. 6 (1) (b) GDPR (pre-contractual measures) or Art. 6 (1) (f) GDPR (legitimate interest in responding to your enquiry). The data is deleted once your enquiry has been dealt with, unless statutory retention obligations apply.

Data processing for travel bookings

When you book a trip, we collect and process the following personal data:

• First and last name, date of birth, nationality
• Contact details (address, email, phone)
• Passport details (number, date of issue and expiry)
• Payment details
• Special requests (e.g. diet, reduced mobility)

The legal basis is Art. 6 (1) (b) GDPR (performance of a contract). Health data is processed on the basis of your explicit consent in accordance with Art. 9 (2) (a) GDPR.

Disclosure to third parties: To carry out your trip, we transfer your data to:

• Airlines
• Hotels and accommodation
• Destination Management Companies (DMCs)
• Local tour guides
• Restaurants (for reservations)
• Authorities (for visa applications)

The data is deleted after the statutory retention periods have expired (generally 10 years for tax-relevant documents).

Transfer of data to third countries

For trips outside the EU/EEA, your data is transferred to service providers and authorities in third countries for which there is no adequacy decision by the EU Commission.

The transfer is necessary for the performance of the travel contract (Art. 49 (1) (b) GDPR).

Insolvency protection

As a tour operator, we are protected against insolvency through R+V Allgemeine Versicherung AG. Your booking data may be transferred to the insolvency insurer for processing in the event of a claim.

The legal basis is Art. 6 (1) (c) GDPR (legal obligation under § 651r BGB).

Payment processing

Bank transfer: If you pay by bank transfer, we process your account details solely to allocate the payment.

PayPal: If you pay via PayPal, you will be redirected to the website of PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. The PayPal privacy policy.

The legal basis is Art. 6 (1) (b) GDPR (performance of a contract).

Cookies

Our website uses technically necessary cookies that are required to operate the website. No consent is required for this (Art. 6 (1) (f) GDPR).

You can set your browser to inform you when cookies are set and to allow them only in individual cases.

SSL/TLS encryption

For security reasons, this website uses SSL or TLS encryption. You can recognise an encrypted connection by https:// in your browser’s address bar.

Your rights

You have the following rights regarding your personal data:

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Updates and changes to this Privacy Policy

This Privacy Policy is dated April 2026. We reserve the right to amend it to reflect changes in the law or in our services.