DRAFT FOR LEGAL REVIEW — DO NOT PUBLISH
REISENBOOKING — PRIVACY POLICY
Proposed copy: 10 November 2026. The company/controller details, actual systems and retention periods must be checked before publication.
1. Controller and contacts
Controller: [VERIFY: full registered entity name, legal form and address]. Privacy contact: [VERIFY: monitored email and postal address]. Data Protection Officer: [VERIFY whether one is appointed and provide contact details if applicable]. The legal controller may differ across hotel fulfilment, payment and other services; distinguish each party's role before publishing.
2. Information we handle
Depending on how you use Reisenbooking, data may include search and travel dates, destination and occupancy preferences, passenger or guest names, age where needed by the supplier, contact details, account and sign-in data, hotel and room choices, bookings and supplier references, cancellation requests, support messages, device and browser information, IP addresses, security logs and payment-related transaction identifiers. Check whether nationality or other identity details are requested by individual suppliers; do not claim that all travellers are asked for those details. Payment-card data entered into hosted payment fields is processed by the payment provider according to its own arrangements; verify whether any card data or tokens are retained by Reisenbooking.
3. Purposes and legal bases
We use data to present accommodation, validate offers, arrange or administer bookings, handle payment steps and service requests, detect abuse, maintain system security, meet accounting/legal requirements, and communicate important booking updates. Potential GDPR legal bases are Article 6(1)(b) for contractual steps, Article 6(1)(c) for legal obligations, Article 6(1)(f) for appropriately balanced legitimate security and operational interests, and Article 6(1)(a) for optional processing based on valid consent. The precise basis for each actual operation must be documented and verified before publishing; legitimate interests should be explained where relied upon.
4. Who receives information
Only the data needed for each purpose should be shared with relevant accommodation providers and booking suppliers, payment processors, cloud and hosting providers, delivery/email services, fraud-prevention partners, professional advisers, and competent authorities when legally required. Relevant suppliers may include GoGlobal and others used at the time of the booking, and the payment provider may include Stripe. Verify each contractual relationship and whether each recipient is a processor or independent controller. Do not assume all processing remains within Germany or the EEA; document any international transfer mechanism and safeguards that apply.
5. Accounts and external sign-in
If Google, Microsoft or other identity sign-in options are offered, the sign-in provider may process account identifiers and authentication data according to its own policies. Reisenbooking should receive only the information required to establish or link the customer's account. Verify the enabled providers, account linking, retention and any separate consent before publishing.
6. Cookies, analytics and marketing
Essential session and security technologies may be needed for login, CSRF defence, checkout continuity and fraud prevention. Optional analytics, advertising, personalisation or marketing cookies require a technology inventory and a valid legal basis; where consent is required it must be obtained before activation and can be withdrawn. Provide a usable cookie-settings control and list actual providers, cookie lifetimes and purposes. Do not publish a claim that Reisenbooking uses no tracking until confirmed by the deployed site and tag inventory.
7. Booking communications and marketing preferences
We may send necessary confirmation, payment-status, cancellation and service notifications to the booking contact. Promotional email or other direct marketing is treated separately and sent only where lawful, with an appropriate opt-out method. Marketing preferences do not prevent essential messages about an existing booking.
8. Storage, security and retention
We should keep each category of personal data only as long as needed for the stated purpose or required by law, subject to appropriate security and access controls. Publish actual retention criteria or periods for account records, booking data, payment references, operational logs and marketing consent records only after verifying them with the deployed systems and German accounting obligations. Describe backups, access control and deletion processes accurately rather than promising immediate erasure of all copies.
9. Rights of individuals
Subject to legal conditions, individuals may request access, rectification, erasure, restriction, portability and objection, and may withdraw consent without affecting earlier lawful processing. A complaint can be made to the relevant data protection supervisory authority. Explain how to contact the verified privacy address. Before publishing, assess whether any automated decision-making covered by Article 22 GDPR occurs and disclose the required information if applicable.
10. Data about other travellers and children
The person making the booking should ensure that other travellers receive relevant privacy information. Details about minors should be requested only where necessary for the accommodation or applicable law, with additional safeguards as required. Review Article 14 GDPR obligations where personal data are received from someone other than the traveller.
11. Changes to this policy
We may update this notice as systems or legal requirements change. The published version should carry an effective date and remain available with a clear description of material changes when appropriate. Earlier published versions should be retained where needed to evidence the notice provided to a customer.
PUBLISHING CHECKLIST: verify controller/DPO/contact, cookie and SDK inventory, Google/Microsoft login arrangements, Stripe and hotel-supplier roles, data hosting location, international transfers, detailed retention schedule, real contact/rights request process, marketing opt-in and cookie withdrawal, and automated decision-making. This is a draft against GDPR Article 13 and Article 14 and requires privacy/legal sign-off.