Privacy Policy
Version: 31.08.2026
1) Information on the Collection of Personal Data and Contact Details of the Controller
1.1 We are pleased that you are visiting our website and thank you for your interest. On the following pages, we inform you about the handling of your personal data when using our website. Personal data is all data with which you can be personally identified. 1.2 The controller in charge of data processing on this website, within the meaning of the General Data Protection Regulation (GDPR), is Nadek UG (haftungsbeschränkt), Friedrichstraße 155, 10117 Berlin, Germany, Phone.: +4915736704839, e-mail: contact@tripsight.app. The controller in charge of the processing of personal data is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.
2) Data Collection When You Visit Our Website
2.1 When using our website for information only, i.e. if you do not register or otherwise provide us with information, we only collect data that your browser transmits to our server (so-called "server log files"). When you visit our website, we collect the following data that is technically necessary for us to display the website to you: - Our visited website - Date and time at the moment of access - Amount of data sent in bytes - Source/reference from which you came to the page - Browser used - Operating system used - IP address used (if applicable: in anonymized form) Data processing is carried out in accordance with Art. 6 (1) point f GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data will not be passed on or used in any other way. However, we reserve the right to check the server log files subsequently, if there are any concrete indications of illegal use. 2.2 This website uses SSL or TLS encryption for security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or inquiries to the controller). You can recognize an encrypted connection by the character string https:// and the lock symbol in your browser line.
3) Hosting & Content Delivery Network
3.1 Vercel For the hosting of our website and the display of the page content, we use the system of the following provider: Vercel Inc, 440 N Barranca Ave #4133, Covina, CA 91723, USA All data collected when accessing and using our website for information purposes is processed on the provider's servers. We have concluded an order processing agreement with the provider, ensuring the protection of our site visitors' data and prohibiting unauthorised disclosure to third parties. For data transfers to the USA, the provider participates in the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision by the European Commission. 3.2 Vercel We use a content delivery network offered by the following provider: Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA This service enables us to deliver large media files such as graphics, page content or scripts faster via a network of regionally distributed servers. The processing is carried out to protect our legitimate interest in improving the stability and functionality of our website pursuant to Art. 6 (1) point f GDPR. We have concluded an order processing agreement with the provider, ensuring the protection of our site visitors' data and prohibiting unauthorised disclosure to third parties. For data transfers to the USA, the provider participates in the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision by the European Commission.
5) Contacting Us
5.1 When you contact us (e.g. via contact form or e-mail), personal data is collected. Which data is collected in the case of a contact form can be seen from the respective contact form. This data is stored and used exclusively for the purpose of responding to your request or for establishing contact and for the associated technical administration. The legal basis for processing data is our legitimate interest in responding to your request in accordance with Art. 6 (1) point f GDPR. If your contact is aimed at concluding a contract, the additional legal basis for the processing is Art. 6 (1) point b GDPR. Your data will be deleted after final processing of your enquiry; this is the case if it can be inferred from the circumstances that the facts in question have been finally clarified, provided there are no legal storage obligations to the contrary. 5.2 - Resend We use the following provider to send transactional emails, i.e. event-driven messages triggered by a specific user interaction (such as the conclusion of a contract, registration or password reset): Plus Five Five, Inc., 2261 Market Street, #5039, San Francisco, CA 94114, USA On the basis of our legitimate interest in effective and user-friendly email communication, we pass on the data you provide when carrying out such a user action to this provider in accordance with art. 6 (1) point f GDPR, so that they can handle the sending of emails on our behalf. We have concluded an order processing agreement with the provider, which safeguards the data of our website visitors and prohibits a disclosure to third parties. For data transfers to the USA, the provider participates in the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision by the European Commission.
6) Data Processing When Opening a Customer Account and for Contract Processing
Pursuant to Art. 6 (1) point b GDPR, personal data will continue to be collected and processed to the extent required in each case if you provide us with this data when opening a customer account. The data required for opening an account can be found in the input mask of the corresponding form on our website. Deletion of your customer account is possible at any time and can be done by sending a message to the above address of the person responsible. After deletion of your customer account, your data will be deleted, provided that all contracts concluded via it have been fully processed, no legal retention periods are opposed and no legitimate interest on our part in the continued storage exists.
7) Use of Client Data for Direct Advertising
Subscribe to our e-mail newsletter If you register for our e-mail newsletter, we will regularly send you information about our offers. The only mandatory data for sending the newsletter is your e-mail address. The provision of further data is voluntary and will be used to address you personally. We use the so-called double opt-in procedure for sending the newsletter. This means that we will only send you an e-mail newsletter once you have expressly confirmed that you consent to receiving newsletters. We will then send you a confirmation e-mail asking you to confirm that you wish to receive the newsletter in future by clicking on an appropriate link. By activating the confirmation link, you give us your consent for the use of your personal data pursuant to Art. 6 (1) point a GPPR. When you register for the newsletter, we store your IP address entered by your Internet service provider (ISP) as well as the date and time of registration for the purpose of tracing any possible misuse of your e-mail address at a later date. The data collected by us when you register for the newsletter is used exclusively for the promotional purposes by way of the newsletter. You can unsubscribe from the newsletter at any time via the link provided for this purpose in the newsletter or by sending a corresponding message to the responsible person named at the beginning. After unsubscribing, your e-mail address will be deleted from our newsletter distribution list immediately, unless you have expressly consented to further use of your data, or we reserve the right to a more extensive use your data which is permitted by law and about which we inform you in this declaration.
8) Processing of Data for the Purpose of Order Handling
8.1 To fulfill the contract, we work with the following service provider(s), who support us in whole or in part in the execution of concluded contracts. Certain personal data is transferred to these service providers in accordance with the following information. 8.2 Use of Payment Service Providers - Stripe Online payment methods from the following provider are available on this website: Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland If you select a payment method of the provider, your payment data provided during the ordering process (including name, address, bank and payment card information, currency and transaction number) as well as information about the content of your order will be passed on to the provider in accordance with Art. 6 (1) point b GDPR. In this case, your data will only be passed on for the purpose of processing payment with the provider and only to the extent necessary for this purpose. 8.3 - Anthropic Claude We use software incorporating artificial intelligence from the following provider to provide our services: Anthropic Ireland Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland Information provided by you within the scope of a contractual relationship may be entered into the provider's software in order to organize, analyze, aggregate, modify, evaluate, or process it for the purpose of delivering our services. Information may also be transmitted to: Anthropic PBC, USA The collection and further processing of this information are strictly limited to the purpose of contract fulfillment. Processing for the purpose of training or further developing the provider's AI language models is expressly prohibited. Where the processing involves personal data, it is carried out based on our legitimate interest in structuring our services efficiently and making optimal use of available resources and technologies, in accordance with Art. 6(1)(f) of the GDPR. If the personal data belongs to third parties and you have entrusted us with its processing, such processing is secured through a data processing agreement concluded with us; this agreement specifies the measures taken to protect the data as well as your rights of control and access. We have concluded an order processing agreement with the provider, that ensures the protection of personal data processed by the provider and prohibits unauthorized disclosure to third parties. For the transfer of data to the USA, the provider relies on standard contractual clauses of the European Commission, which are meant to ensure compliance with the European level of data protection. 8.4 Electronic termination option for continuing obligations with consumers Consumers who have concluded contracts on this website for continuing obligations for which payment is required (e.g., subscription contracts) have the option of terminating these contracts via an electronic button in accordance with the applicable notice periods. Pressing the button leads to a confirmation page on which the consumer can provide more detailed information on the termination, clearly identify himself and subsequently declare his termination electronically. The collection of personal data and its transmission to us is carried out in accordance with Art. 6 (1) point b GDPR and only to the extent necessary for the proper processing of the termination. Pursuant to Art. 6 (1) point b GDPR, the provided personal data will also be used to confirm receipt of the termination declaration and the termination date by electronic means in text form. The additional legal basis for such processing is Art. 6 (1) point c GDPR. We are legally obliged to provide an electronic termination option for consumer contracts concluded by means of electronic commerce regarding continuing obligations for which payment is required. 8.5 Electronic Withdrawal Function for Distance Contracts Consumers who conclude contracts on this website for which a statutory right of withdrawal exists have the option to declare their withdrawal via an electronic withdrawal function, in accordance with the applicable withdrawal provisions. When using the withdrawal function, in addition to details identifying the specific contract being withdrawn from, other personal information—such as the consumer's first name, last name, and email address—must be provided or confirmed. The collection of this information and its transmission to us is carried out in accordance with Art. 6 (1) point b of the GDPR, and only to the extent necessary for the proper processing of the withdrawal request. Furthermore, and also based on Art. 6 (1) point b of the GDPR, the provided personal data is used to confirm receipt of the withdrawal declaration via email. An additional legal basis for this processing is Art. 6 (1) point c of the GDPR. We are legally obligated to provide an electronic cancellation function for remunerated distance contracts concluded with consumers.
9) Online Marketing
9.1 AWIN Performance Advertising Network We participate in the affiliate programme of the following provider: AWIN AG, Eichhornstraße 3, 10785 Berlin, Germany In this context, we have placed links on our website that lead to offers on websites of the provider or third parties ("affiliate sites"). In order to measure the success of an affiliate link, the analysis of orders generated via such a link and the corresponding settlement of commission payments, the provider uses cookies and/or similar technologies which are generally set on the affiliate sites and for which we are not responsible in this respect under data protection law. In doing so, the provider also regularly processes the IP address and, if applicable, further end device information. All of the processing described above, in particular the reading or saving of information on the end device used by you, will only be carried out if you have given your express consent to this in accordance with Art. 6 (1) point a GDPR. You can revoke your consent at any time with effect for the future by using the cookie consent management options on the affiliate sites. 9.2 CJ Affiliate Partner Network We participate in the affiliate programme of the following provider: CJ Affiliate (Conversant Europe Limited), 1st Floor, 40 Dukes Place, London, EC3A 7NH , UK In this context, we have placed links on our website that lead to offers on websites of the provider or third parties ("affiliate sites"). In order to measure the success of an affiliate link, the analysis of orders generated via such a link and the corresponding settlement of commission payments, the provider uses cookies and/or similar technologies which are generally set on the affiliate sites and for which we are not responsible in this respect under data protection law. In doing so, the provider also regularly processes the IP address and, if applicable, further end device information. All of the processing described above, in particular the reading or saving of information on the end device used by you, will only be carried out if you have given your express consent to this in accordance with Art. 6 (1) point a GDPR. You can revoke your consent at any time with effect for the future by using the cookie consent management options on the affiliate sites. In case of data transfer to the provider's location, an adequate level of data protection is guaranteed by an adequacy decision of the European Commission. 9.3 DiscoverCars We participate in the affiliate programme of the following provider: Discover Car Hire AS, Kārļa Ulmaņa gatve 2, Riga, LV-1004, Latvia In this context, we have placed links on our website that lead to offers on websites of the provider or third parties ("affiliate sites"). In order to measure the success of an affiliate link, the analysis of orders generated via such a link and the corresponding settlement of commission payments, the provider uses cookies and/or similar technologies which are generally set on the affiliate sites and for which we are not responsible in this respect under data protection law. In doing so, the provider also regularly processes the IP address and, if applicable, further end device information. All of the processing described above, in particular the reading or saving of information on the end device used by you, will only be carried out if you have given your express consent to this in accordance with Art. 6 (1) point a GDPR. You can revoke your consent at any time with effect for the future by using the cookie consent management options on the affiliate sites. 9.4 Omio We participate in the affiliate programme of the following provider: Omio Travel GmbH, Warschauer Platz 12, 10245 Berlin, Germany In this context, we have placed links on our website that lead to offers on websites of the provider or third parties ("affiliate sites"). In order to measure the success of an affiliate link, the analysis of orders generated via such a link and the corresponding settlement of commission payments, the provider uses cookies and/or similar technologies which are generally set on the affiliate sites and for which we are not responsible in this respect under data protection law. In doing so, the provider also regularly processes the IP address and, if applicable, further end device information. All of the processing described above, in particular the reading or saving of information on the end device used by you, will only be carried out if you have given your express consent to this in accordance with Art. 6 (1) point a GDPR. You can revoke your consent at any time with effect for the future by using the cookie consent management options on the affiliate sites. 9.5 SnowTrex We participate in the affiliate programme of the following provider: TravelTrex GmbH, Bonner Straße 484–486, 50968 Cologne, Germany In this context, we have placed links on our website that lead to offers on websites of the provider or third parties ("affiliate sites"). In order to measure the success of an affiliate link, the analysis of orders generated via such a link and the corresponding settlement of commission payments, the provider uses cookies and/or similar technologies which are generally set on the affiliate sites and for which we are not responsible in this respect under data protection law. In doing so, the provider also regularly processes the IP address and, if applicable, further end device information. All of the processing described above, in particular the reading or saving of information on the end device used by you, will only be carried out if you have given your express consent to this in accordance with Art. 6 (1) point a GDPR. You can revoke your consent at any time with effect for the future by using the cookie consent management options on the affiliate sites. 9.6 Viator We participate in the affiliate programme of the following provider: Viator, Inc., 400 1st Avenue, Needham, MA 02494, USA In this context, we have placed links on our website that lead to offers on websites of the provider or third parties ("affiliate sites"). In order to measure the success of an affiliate link, the analysis of orders generated via such a link and the corresponding settlement of commission payments, the provider uses cookies and/or similar technologies which are generally set on the affiliate sites and for which we are not responsible in this respect under data protection law. In doing so, the provider also regularly processes the IP address and, if applicable, further end device information. All of the processing described above, in particular the reading or saving of information on the end device used by you, will only be carried out if you have given your express consent to this in accordance with Art. 6 (1) point a GDPR. You can revoke your consent at any time with effect for the future by using the cookie consent management options on the affiliate sites. For the transfer of data to the USA, the provider relies on standard contractual clauses of the European Commission, which are meant to ensure compliance with the European level of data protection.
10) Web Analysis Services
Vercel Analytics This website uses a web analytics service provided by the following provider: Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA To protect website visitors, the provider uses a pseudonymised visitor identifier to enable various analyses of website usage within a short time frame of no more than 24 hours. This visitor identifier is a randomly generated, time-limited hash value created on the basis of a reduced set of technical attributes. These include, in particular, the user agent (information about the browser and operating system) and the anonymised IP address, which is processed solely for the duration of the analysis and is subsequently discarded. Should personal data nevertheless be processed in individual cases, such processing is carried out on the basis of our legitimate interest in the statistical analysis of usage behaviour for optimisation purposes, in accordance with Article 6 (1) point f of the GDPR. In this case, you may permanently object to the collection and storage of your visitor data in future by notifying us. We have entered into a data processing agreement with the provider, which ensures the protection of our website visitors’ data and prohibits unauthorised disclosure to third parties. For data transfers to the USA, the provider has adhered to the EU-US Data Privacy Framework, which, on the basis of an adequacy decision by the European Commission, ensures compliance with European data protection standards.
11) Site Functionalities
11.1 Apple Single Sign-On On our website we provide a single sign-on function offered by the following provider: Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland If you have an account with the provider, you can use this account data to create a user account or to register on our website. When you visit this page, a direct connection between your browser and the provider's servers can be established via this login function, even if you do not have an account with the provider or are not logged in to one. The provider thereby receives the information that you have visited our site. The information collected in this respect (including your IP address, if applicable) is transmitted by your browser directly to a server of the provider and stored there. However, the information is not used to identify you personally and is not passed on to third parties. These data processing operations are carried out in accordance with Art. 6 (1) point f GDPR based on our legitimate interest in a user-friendly and interactive design of our online presence. If you click on the registration button to register with your account data by logging into the provider's website, the provider will transmit the general and publicly accessible information stored in your account (user ID, name, address, e-mail address, age, and gender) to us based on your express consent pursuant to Art. 6 (1) point a GDPR. We store and use the data transmitted by the provider to set up a user account containing the necessary data (title, first name, surname, address data, country, email address, date of birth), if you have released that data to the provider. Conversely, data (e.g., information about your surfing or purchasing behavior) may be transferred from us to your account held with the provider based on your consent. The consent given can be revoked at any time with effect for the future vis-à-vis us. 11.2 Google Sign-In On our website we provide a single sign-on function offered by the following provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 ESW5, Ireland In addition to the transfer of data to the above-mentioned provider location, data may also be transferred to: Google LLC, USA If you have an account with the provider, you can use this account data to create a user account or to register on our website. When you visit this page, a direct connection between your browser and the provider's servers can be established via this login function, even if you do not have an account with the provider or are not logged in to one. The provider thereby receives the information that you have visited our site. The information collected in this respect (including your IP address, if applicable) is transmitted by your browser directly to a server of the provider and stored there. However, the information is not used to identify you personally and is not passed on to third parties. These data processing operations are carried out in accordance with Art. 6 (1) point f GDPR based on our legitimate interest in a user-friendly and interactive design of our online presence. If you click on the registration button to register with your account data by logging into the provider's website, the provider will transmit the general and publicly accessible information stored in your account (user ID, name, address, e-mail address, age, and gender) to us based on your express consent pursuant to Art. 6 (1) point a GDPR. We store and use the data transmitted by the provider to set up a user account containing the necessary data (title, first name, surname, address data, country, email address, date of birth), if you have released that data to the provider. Conversely, data (e.g., information about your surfing or purchasing behavior) may be transferred from us to your account held with the provider based on your consent. The consent given can be revoked at any time with effect for the future vis-à-vis us. Further information on Google's privacy standards can be found here: https://business.safety.google/privacy/ For data transfers to the USA, the provider participates in the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision by the European Commission. 11.3 - Supabase On our website, we use the service provided by the following provider to verify registration and login attempts for restricted areas of the site: Supabase, Inc., 548 Market St, San Francisco, CA 94104, USA Solely on the basis of our legitimate interest in safeguarding the structural and data security of our website, your registration details (email address, username and password) are transmitted to the provider for authentication in accordance with Article 6 (1) point f GDPR, in order to determine whether to authorise the registration attempt. We have entered into a data processing agreement with the provider which protects the data of our website visitors and prohibits disclosure to third parties. For the transfer of data to the USA, the provider relies on the European Commission’s Standard Contractual Clauses, which are intended to ensure compliance with European data protection standards. 11.4 OpenStreetMap This website uses an online map service provided by the following provider: OpenStreetMap Foundation, St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, UK The online map service is a tool for displaying interactive maps in order to visually present geographical information. By using this service, our location is displayed to you and any geolocation is made easier. Already when accessing those sub-pages in which the map of the provider is integrated, information about your use of our website (such as your IP address) is transferred to servers of the provider and stored there. The processing of your personal data is carried out in accordance with Art. 6 (1) point f GDPR on the basis of our legitimate interest in the demand-oriented design of our website. If you do not agree to the future transfer of your data to the provider, it is possible to completely deactivate the provider's online map service by deactivating the JavaScript application in your browser. The online map service on this website can then no longer be used. To the extent legally required, we have obtained your consent for the processing of your data as described above in accordance with Art. 6 (1) point a GDPR. You can revoke your consent at any time with effect for the future. In order to exercise your revocation, please follow the option described above for making an objection. For a data transfer to the provider location, an adequate level of data protection is guaranteed by an adequacy decision of the European Commission. 11.5 - hCaptcha On this website, we use the CAPTCHA service of the following provider: Intuition Machines, Inc., 350 Alabama St, San Francisco, CA 94110, USA The service checks whether an input is made by a natural person or abusively by machine and automated processing with the aim of blocking spam, DDoS attacks and similar automated malicious attacks. To ensure whether an action is performed by a human being and not by an automated bot, Cloudflare Turnstile collects the IP address of the end device used, the recognition data of the browser, the operating system type and the date and duration of the visit and transmits these data to the provider's servers to be evaluated. This process is based on our legitimate interest in determining individual responsibility when using the Internet and in preventing abuse and spam in accordance with Art. 6 Para. 1 lit. f GDPR. We have concluded an order processing contract with the provider, ensuring the protection of our site visitors' data and prohibiting unauthorized disclosure to third parties. For the transfer of data to the USA, the provider relies on standard contractual clauses of the European Commission, which are meant to ensure compliance with the European level of data protection. 11.6 - Unsplash On some of our web pages, we use the server capacity of the following provider to display image files: Unsplash Inc., 400 Rue McGill, Suite 500, Montreal, Quebec H2Y 2G1, Canada Image content can be delivered and displayed in a targeted manner via the provider’s servers. When you access a page on our website that contains the provider’s content, a connection is established with the provider’s servers in order to load the relevant content. In doing so, your IP address is collected and transmitted to the provider to enable the external content to be delivered in a manner appropriate to your location. No personal data other than your IP address is transmitted to the provider. Once the content has been loaded, your IP address is deleted by the provider. The legal basis for the processing is our legitimate interest in designing our online offering in a resource-efficient and appealing manner, in accordance with Article 6 (1) point f GDPR. Where data is transferred to the provider’s location, an adequate level of data protection is guaranteed by an adequacy decision of the European Commission.
12) Tools and Miscellaneous
12.1 - Lexware Office For the execution of the accounting, we use the service of the cloud-based accounting software of the following provider: Haufe-Lexware GmbH & Co. KG, Munzinger Straße 9, 79111 Freiburg, Germany The provider processes incoming and outgoing invoices and, if applicable, also the bank transactions of our company in order to automatically record invoices, match them to the transactions and create the financial accounting from this in a semi-automated process. Insofar as personal data is also processed in this context, the processing is carried out in accordance with Art. 6 (1) point f GDPR on the basis of our legitimate interest in the efficient organisation and documentation of our business transactions. 12.2 Upstash For security purposes, this website uses the service of the following provider: Upstash, Inc., 6202 Vía De Adrianna, San Jose, CA 95120, USA The provider protects the website and the associated IT infrastructure from unauthorised third-party access, cyber attacks and viruses and malware. The provider collects the IP addresses of users and, if necessary, further data on their behaviour on our website (in particular URLs accessed and header information) in order to detect and defend against illegitimate page accesses and dangers. In doing so, the collected IP address is compared with a list of known attackers. If the captured IP address is identified as a security risk, the provider can automatically block it from accessing the website. The information collected in this way is transferred to a server of the provider and stored there. The described data processing is carried out in accordance with Art. 6 (1) point f GDPR on the basis of our legitimate interests in protecting the website from harmful cyber attacks and in maintaining structural and data integrity and security. We have concluded an order processing agreement with the provider, which ensures the protection of our website visitors' data and prohibits unauthorised disclosure to third parties. For data transfers to the USA, the provider participates in the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision by the European Commission. 12.3 Sentry This website uses an automatic error reporting service from the following provider: Functional Software Inc., 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA In the event of technical complications or functional impairments in connection with the operation of the software of the provider, the system sends automatic error reports to the provider containing information on the respective source of the error and its origin. Server information as well as usage parameters such as the IP address, the browser used, time stamps and the URL accessed are transferred. Depending on the origin of the error, error reports may also contain further personal customer data that we have collected and stored in the course of the conclusion of a contract (in particular first name and surname, address, e-mail address). This is always possible if the error occurs in connection with a software-based processing of customer data. Insofar as personal data is also involved in the information transferred in this way, the processing is carried out in accordance with Art. 6 (1) point f GDPR on the basis of our legitimate interest in an efficient error cause analysis to improve the reliability and functionality of our website. For data transfers to the USA, the provider participates in the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision by the European Commission.
13) Rights of the Data Subject
13.1 The applicable data protection law grants you the following comprehensive rights of data subjects (rights of information and intervention) vis-à-vis the data controller with regard to the processing of your personal data: - Right of access by the data subject pursuant to Art. 15 GDPR; - Right to rectification pursuant to Art. 16 GDPR; - Right to erasure (“right to be forgotten”) pursuant to Art. 17 GDPR; - Right to restriction of processing pursuant to Art. 18 GDPR; - Right to be informed pursuant to Art. 19 GDPR; - Right to data portability pursuant to Art. 20 GDPR; - Right to withdraw a given consent pursuant to Art. 7 (3) GDPR; - Right to lodge a complaint pursuant to Art. 77 GDPR. 13.2 RIGHT TO OBJECT IF, WITHIN THE FRAMEWORK OF A CONSIDERATION OF INTERESTS, WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR PREDOMINANT LEGITIMATE INTEREST, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THIS PROCESSING WITH EFFECT FOR THE FUTURE ON THE GROUNDS THAT ARISE FROM YOUR PARTICULAR SITUATION. IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED. HOWEVER, WE RESERVE THE RIGHT TO FURTHER PROCESSING IF WE CAN PROVE COMPELLING REASONS WORTHY OF PROTECTION FOR PROCESSING WHICH OUTWEIGH YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING SERVES TO ASSERT, EXERCISE OR DEFEND LEGAL CLAIMS. IF WE PROCESS YOUR PERSONAL DATA FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA WHICH ARE USED FOR DIRECT MARKETING PURPOSES. YOU MAY EXERCISE THE OBJECTION AS DESCRIBED ABOVE. IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED FOR DIRECT ADVERTISING PURPOSES.
14) Duration of Storage of Personal Data
The duration of the storage of personal data is based on the respective legal basis, the purpose of processing and - if relevant – on the respective legal retention period (e.g. commercial and tax retention periods). If personal data is processed on the basis of express consent pursuant to Art. 6 (1) point a GDPR, this data is stored until the data subject revokes his consent. If there are legal storage periods for data that is processed within the framework of legal or similar obligations on the basis of Art. 6 (1) point b GDPR, this data will be routinely deleted after expiry of the storage periods if it is no longer necessary for the fulfillment of the contract or the initiation of the contract and/or if we no longer have a justified interest in further storage. When processing personal data on the basis of Art. 6 (1) point f GDPR, this data is stored until the data subject exercises his right of objection in accordance with Art. 21 (1) GDPR, unless we can provide compelling grounds for processing worthy of protection which outweigh the interests, rights and freedoms of the data subject, or the processing serves to assert, exercise or defend legal claims. If personal data is processed for the purpose of direct marketing based on Art. 6 (1) point f GDPR, this data is stored until the data subject exercises his right of objection pursuant to Art. 21 (2) GDPR. Unless otherwise stated in the information contained in this declaration on specific processing situations, stored personal data will be deleted if it is no longer necessary for the purposes for which it was collected or otherwise processed.
15) Retention periods by data category
In addition to the general information on retention above, the following periods apply to the individual categories of data: – Account data — retained for as long as your account is active. Deleted within 30 days of account deletion. – Search preferences — retained for as long as your account is active or until you clear your browser storage. – Usage counters — retained for 30 rolling days. – Payment and accounting records — retained for the statutory retention periods under German tax and commercial law: generally eight years for accounting vouchers and invoices (§ 147(3) AO, § 14b UStG), and ten years where a ten-year retention obligation applies (such as commercial books and annual accounts, § 257 HGB). – Cancellation and withdrawal declarations — kept as legally required proof for the duration of the commercial- and tax-law retention periods (§ 257 HGB, § 147 AO), regularly six years, and beyond that for as long as necessary for the establishment, exercise or defence of legal claims. This also applies if you have no user account or your account has since been deleted. – Consent records for opt-in e-mails — when you confirm the double opt-in link, we store the IP address and the date and time of that confirmation as proof of your consent. After a withdrawal we no longer base this record on your consent but on Art. 6(1)(f) GDPR — our legitimate interest in being able to demonstrate that the e-mails sent up to that point were lawful (Art. 7(1) GDPR, § 7(2) UWG). We therefore keep it for the regular limitation period of three years (§ 195 BGB), which under § 199(1) BGB only starts to run at the end of the relevant year; it is deleted no later than four years after the consent ends. This does not affect the withdrawal itself: your address is removed from the distribution list immediately and you will receive no further opt-in e-mails. – Weekly digest send history — if you have subscribed to the weekly e-mail digest (section 7), we store the destinations most recently featured in it (at most six entries) so that consecutive e-mails do not repeat the same suggestions. If you unsubscribe you receive no further e-mails; we keep this short record so that the variety takes effect immediately should you subscribe again. Retained for as long as your account is active; deleted upon account deletion. We will delete it sooner on request — please use the contact details given at the beginning of this policy. – Server logs — retained for up to 30 days by the hosting provider. – Error reports — retained for up to 90 days by the error-reporting provider.
16) Where your account and trip data is stored
Your account data (e-mail address, the authentication data required for your account — passwords are not stored in plain text — and a name if you choose to provide one), your saved trips, your search and travel preferences and your subscription status — whether created via the website or the mobile app — are stored in a database provided by: Supabase, Inc., 548 Market St, San Francisco, CA 94104, USA. The primary database used for TripSight is hosted in the EU region Frankfurt am Main. The legal basis is Art. 6(1)(b) GDPR, as storage is necessary in order to perform the user agreement concluded with you. We have entered into a data processing agreement pursuant to Art. 28 GDPR with the provider.
17) Automated decision-making and profiling (Art. 22 GDPR)
TripSight ranks destinations algorithmically based on the preferences you submit (dates, budget, vibes, food, passport). This ranking does not produce legal effects concerning you or similarly significantly affect you within the meaning of Art. 22 GDPR. We do not use automated decision-making for credit, hiring, insurance, pricing or any other consequential decision.
18) Children's data
TripSight is not directed at children under the age of 16. Persons under 16 should not create an account or provide personal data to us. If we become aware that personal data has been provided to us by a person under 16 without the necessary authorisation, we will take appropriate steps to delete it. If you become aware of this, please contact us at contact@tripsight.app.
19) Data security (Art. 32 GDPR)
We implement appropriate technical and organisational measures pursuant to Art. 32 GDPR: HTTPS/TLS for all data in transit, row-level security in our database so that users can only access their own data, environment-variable management for all API keys and secrets, the principle of least privilege for processor access, and regular updates of the software components we use.
20) Data breaches (Art. 33, 34 GDPR)
In the event of a personal data breach, we will notify the competent supervisory authority without undue delay and, where feasible, no later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to your rights and freedoms (Art. 33 GDPR). Where the breach is likely to result in a high risk, we will additionally inform the affected users without undue delay (Art. 34 GDPR).
21) Supervisory authority and Data Protection Officer
Under Art. 77 GDPR you have the right to lodge a complaint with the supervisory authority of the EU member state where you live, work, or where the alleged infringement occurred. Our competent supervisory authority is the Berlin Commissioner for Data Protection and Freedom of Information (BlnBDI), https://www.datenschutz-berlin.de. We have not appointed a Data Protection Officer. For all data-protection questions, please use the contact details given at the beginning of this policy.
22) Changes to this policy
We may update this privacy policy from time to time. We will communicate material changes by e-mail or by a notice on the website. The date given above reflects the most recent revision.
23) Profile picture when signing in with Google
Supplementing section 11.2: if you sign in via Google Sign-In, Google also transmits to us the internet address (URL) of the profile picture stored in your Google account in addition to the data listed there; the image file itself remains with Google and is loaded directly from there by your browser when displayed. We use the address solely to display the picture to you in your own account and in the navigation bar; it is not visible to other users. The legal basis is Art. 6(1)(b) GDPR (provision of your user account). No profile picture is transmitted when you sign in with Apple. If you prefer not to have your Google profile picture used, you can register with your e-mail address or sign in with Apple instead, or contact us using the details given at the beginning of this policy and we will remove the picture address from your account.
24) Scope: our mobile app
This privacy policy also applies to our mobile app for iOS and Android. When you use the mobile app, the sections above apply accordingly unless stated otherwise below. The mobile app obtains its content through requests to our servers; this processes the same access data as visiting our website (in particular IP address, time of the request and technical details of your device), hosted by the provider named in section 3.1. If you are signed in, requests also carry your sign-in token. The legal bases are Art. 6(1)(b) GDPR (providing the mobile app's functions) and Art. 6(1)(f) GDPR (stability and security).
25) Device location
On request, the mobile app suggests destinations from your current location. For this it asks the operating system for the approximate-location permission; location is accessed only while you are using the mobile app (no background access) and only if you grant the permission — you can always type your departure city by hand instead. To turn coordinates into a place name the mobile app uses your operating system's geocoding service; your device thereby transmits the coordinates to Apple (iOS) or Google (Android), each acting as an independent controller. The resulting place is treated like a manually entered city (section 16); we do not permanently store the coordinates themselves. The legal basis is your consent, Art. 6(1)(a) GDPR; you can withdraw it at any time with effect for the future in your device settings.
26) Push notifications
We send weather alerts and updates on watched destinations as push notifications only if you enable them in the mobile app and grant your operating system's notification permission. For this the mobile app generates a push token via the service of the following provider: 650 Industries, Inc. ("Expo"), 624 University Ave FL1, Palo Alto, CA 94301, USA. We store the token in your user account in order to address messages to your device. The provider stores the token for delivery purposes; it processes the content of notifications only for as long as sending takes and does not store it. We have entered into a data processing agreement with the provider which includes the EU Commission's Standard Contractual Clauses; for data transfers to the USA, the provider additionally participates in the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision by the European Commission. Delivery runs through your operating system's push services — Apple Push Notification service (Apple) or Firebase Cloud Messaging (Google) — operated by the respective platform provider. The legal basis is your consent, Art. 6(1)(a) GDPR. If you disable push notifications in the mobile app, we remove the token from your user account with us; if you disable them in your device settings instead, your operating system stops delivery.
27) Updates of the mobile app (over-the-air)
When the mobile app is launched, it checks via the service of the provider Expo referred to in section 26 whether an updated version of the mobile app's non-native components is available and, where applicable, downloads it. In this process, technically necessary information is transmitted to the provider's servers, in particular the platform used (iOS or Android), the mobile app's runtime version, and the IP address generated as part of the network connection. Depending on the configuration, additional technical information, such as the update channel used, may be transmitted. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to keep the mobile app up to date, functional and secure and to provide bug fixes and improvements promptly.
28) Purchases via the app stores
If you take out a subscription in the mobile app, the purchase is handled entirely by the operator of the respective app store — Apple or Google. The store operator processes your payment and billing data as an independent controller under its own privacy policy; we receive no payment data, only information on the existence and status of the subscription. Such subscriptions are managed and cancelled in the respective store's subscription settings.
29) Subscription management (RevenueCat)
To technically manage subscriptions taken out via the app stores we use the service of the following provider: RevenueCat, Inc., 1032 E Brandon Blvd #3003, Brandon, FL 33511, USA. For this purpose the provider receives the identifier of your user account (a pseudonymous string), the purchase information reported by the respective store — in particular purchase receipts (Apple receipt data or Google purchase tokens) and the start, renewal or end of the subscription —, technical information about your device and operating system from the embedded SDK, and the time of the last use of the mobile app, and provides us with the resulting subscription status. The provider does not receive payment data from us. The legal basis is Art. 6(1)(b) GDPR (performance of the subscription). We have entered into a data processing agreement pursuant to Art. 28 GDPR with the provider. For the transfer of data to the USA, the provider relies on Standard Contractual Clauses of the European Commission, which are intended to ensure compliance with the European level of data protection.
30) Map view in the mobile app
If you open the map view in the mobile app, the map content is loaded from your operating system's map service: Apple Maps (Apple) on iOS or Google Maps (Google) on Android. Your device thereby transmits the data required to fetch the map tiles (in particular IP address and the displayed map section) to the respective provider as an independent controller. The map shows destination markers only; your own location is neither requested nor displayed on the map. The map is only loaded once you actively select the map view. The legal basis is Art. 6(1)(f) GDPR — our legitimate interest in presenting destinations clearly.
31) Error and crash reports in the mobile app
In addition to the error-reporting section above, the following applies to the mobile app: if an error or crash occurs, the mobile app transmits a technical report to the provider Sentry named there. The report contains in particular the device model, operating-system version, app version, the technical error context and the last screen displayed. User identifiers are contained exclusively as cryptographic hashes; text you have typed is removed before transmission, and no payment data arises in the mobile app. The legal basis is Art. 6(1)(f) GDPR — our legitimate interest in operating a stable, error-free mobile app.
32) hCaptcha in the mobile app
We also use the bot detection via hCaptcha described in this policy in the mobile app — for registration, password sign-in, password reset, changing the e-mail address and re-sending the confirmation e-mail. The check is loaded from the provider in an embedded browser view; the statements in the hCaptcha section above apply accordingly. No hCaptcha check takes place when you sign in with Apple or Google.
33) Travel photos in the mobile app
The embedding of travel photos from the provider Unsplash described in this policy applies accordingly in the mobile app: your device loads the image files directly from the provider's servers, transmitting your IP address in the process. If you tap the photo credit, the provider's photo page opens in your browser.
34) Signing in with Apple or Google in the mobile app
The single-sign-on procedures described in sections 11.1 and 11.2 are also available to you in the mobile app. There, sign-in uses the native sign-in function provided by the operating system; the nature and scope of the data transmitted and the legal bases correspond to those sections. Section 23 (profile picture with Google sign-in) applies in the mobile app with the proviso that the profile picture is currently not displayed there.
35) Local storage on your device
The mobile app stores certain data exclusively locally on your device: your sign-in session in the operating system's secured keystore, and — to speed up the mobile app and minimise data transfers — cached content (such as weather data, photos and your app settings). This storage is strictly necessary for operating the mobile app (§ 25(2) no. 2 TDDDG) and requires no consent. The cached content remains on your device and is not read by us; the sign-in session is used to authenticate your requests to our servers. You can remove this data at any time: the cached content via the mobile app's "Clear cached data" function, the sign-in session by signing out, and all local data by uninstalling the mobile app. ---
This privacy policy has been created by the specialist lawyers of IT-Recht Kanzlei and is protected by copyright (https://www.it-recht-kanzlei.de)
Sections 15 to 35 were drafted by the operator and are not covered by the notice above.