Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

2. Hosting and server log files

This website is hosted on Amazon Web Services (AWS) and delivered via the Amazon CloudFront content delivery network. The provider is Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg. When you visit the website, information transmitted by your browser is automatically processed in so-called server log files:

• IP address of the requesting device
• date and time of access
• page or file accessed
• browser type and version as well as operating system (user agent)
• referrer URL (previously visited page)

This processing is based on Art. 6(1)(f) GDPR, our legitimate interest in providing the website securely, reliably and efficiently. The data is not combined with other data sources. As CloudFront is a global network, data may be transferred to the USA; Amazon is certified under the EU-US Data Privacy Framework (DPF), which ensures an adequate level of data protection.

3. Contact form

When you send us an enquiry via the contact form, we process the data you enter: name and email address (required) and – if provided – phone number, desired tour, preferred date, number of persons and the content of your message. We use this data solely to process and respond to your enquiry.

The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures, e.g. booking enquiries) or Art. 6(1)(f) GDPR (legitimate interest in answering general enquiries).

Your enquiry is delivered to us as an email via the Gmail service. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; the parent company is Google LLC, USA. Google is certified under the EU-US Data Privacy Framework. We retain your enquiry until it has been fully processed and no statutory retention obligations remain.

4. Google reCAPTCHA

To protect the contact form against spam and abuse, we use Google reCAPTCHA v3 provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The service is only loaded when you interact with the contact form – no connection to reCAPTCHA is established when you merely visit the website.

reCAPTCHA analyses various characteristics in the background to assess whether the input is made by a human. This may include processing your IP address, information about your browser and operating system, mouse movements and time spent on the page, as well as cookies set by Google. The data is transmitted to Google and may be transferred to the USA (certified under the EU-US Data Privacy Framework).

The legal basis is Art. 6(1)(f) GDPR – our legitimate interest in protecting our website against abusive automated access and spam. Further information can be found in Google's privacy policy and Google's terms of service.

5. Map display (Mapbox)

We use a static map image from the Mapbox service (Mapbox Inc., USA) to display directions. The map image is retrieved by our server and delivered to you – your browser does not establish a direct connection to Mapbox, and none of your personal data is transmitted to Mapbox.

6. Cookies and web analytics

This website does not use any analytics or tracking tools and does not set any cookies itself. Only Google reCAPTCHA may set cookies when you use the contact form (see section 4). Fonts are hosted locally on our server; no requests are made to Google Fonts or other external font services.

7. SSL/TLS encryption

For security reasons and to protect the transmission of confidential content – such as enquiries you send us via the contact form – this website uses SSL/TLS encryption. You can recognise an encrypted connection by the lock symbol in your browser's address bar and by the address beginning with "https://".

8. Links to external services

Our website contains links to external services, such as WhatsApp (Meta Platforms Ireland Ltd.) for getting in touch and Google Maps for route planning. When you click such a link, you leave our website; only then is data transmitted to the respective provider. The privacy policy of the respective provider applies.

9. Your rights

Under the GDPR, you have the following rights:

• access to the data we hold about you (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure of your data (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to processing based on legitimate interests (Art. 21 GDPR)

To exercise your rights, an informal message to dianamettcher@gmail.com is sufficient. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Access to Information of Brandenburg (LDA), Stahnsdorfer Damm 77, 14532 Kleinmachnow, Germany, www.lda.brandenburg.de.

10. Version and changes to this privacy policy

Version: July 2026. We will update this privacy policy whenever the data processing on this website changes.