Privacy Policy

1. Controller

Controller for the data processing on this site:
Lanka Reisen, [address], hallo@lanka-reisen.de.

2. Hosting (Cloudflare)

This site is hosted by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). Cloudflare processes technical data (e.g. IP address, user agent) to serve the site and protect it from attacks. Legal basis: Art. 6(1)(f) GDPR. EU Standard Contractual Clauses are in place.

3. Server logs

Visiting this site automatically generates server logs (date, IP, browser, page). These are automatically deleted within 14 days.

4. Contact & booking forms

When you contact us through the contact or booking form, we process your data (name, email, optionally phone, travel dates, notes) solely to handle your request or booking. Legal basis: Art. 6(1)(b) GDPR (contract/pre-contract). Retention: until resolved, then per commercial and tax retention obligations.

5. Payment processing (Stripe)

Payments are processed by Stripe Payments Europe Ltd. Stripe processes the payment data directly (PCI-DSS-certified); we do not see card numbers. Stripe's privacy policy: stripe.com/privacy. Legal basis: Art. 6(1)(b) GDPR.

6. CRM (Airtable)

Booking and contact records are stored in Airtable (Airtable Inc., USA) under EU SCCs. Privacy: airtable.com/privacy.

7. Transactional email (Resend)

Confirmation and reminder emails are sent via Resend (Resend, Inc., USA). Legal basis: Art. 6(1)(b) GDPR.

8. Anti-spam (Cloudflare Turnstile)

We use Cloudflare Turnstile as spam protection. Turnstile is cookieless and GDPR-compliant.

9. Analytics (Plausible / Cloudflare Web Analytics)

We use only cookieless, anonymised analytics tools that do not process personal data and therefore don't require consent.

10. Your rights

You have the right to access, rectify, erase, restrict processing of, port and object to your data. Requests to hallo@lanka-reisen.de. You may also lodge a complaint with your supervisory authority.

Note: this is a template. Have it reviewed by a qualified lawyer before going live — especially the sections on third-country data transfer and the specific services used.