Privacy policy

Controller

Controller within the meaning of Art. 4 (7) GDPR: ShortTrips GmbH, Im Starkfeld 50, 89231 Neu-Ulm, Germany. Managing director: Aleksandr Sazonov. Email: info@shortt.de.

We have not appointed a data protection officer, as the company does not meet the criteria of Art. 37 GDPR. For any question about data processing write to info@shortt.de.

Visiting the website

When you open a page, our hosting provider automatically stores technical data: IP address, date and time of the request, the requested page, browser type and operating system. We need this to deliver the page and to protect the site against failures and abuse.

The legal basis is Art. 6 (1) (f) GDPR, our legitimate interest in a stable and secure website. Log entries are deleted automatically within 30 days.

Fonts are served from our own server: loading a page does not create requests to third-party font services.

Booking requests and correspondence

The booking form asks for your name, email address, phone number, the chosen departure and the number of travellers. We need this to contact you and to organise the trip.

The legal basis is Art. 6 (1) (b) GDPR (pre-contractual measures and performance of a contract). If you write to us on Telegram or by email, we process the content of that correspondence on the basis of Art. 6 (1) (f) GDPR.

Booking data is kept until the trip is completed and afterwards for the statutory retention periods for commercial and tax records (as a rule 6 to 10 years under § 257 HGB and § 147 AO).

Buying guides and maps

When you buy a digital guide we process your email address and order details. Payment is handled by Stripe Payments Europe, Ltd.: card details are entered on Stripe's side, we neither see nor store them.

The legal basis is Art. 6 (1) (b) GDPR. Transaction records are kept for the periods required by German tax and commercial law.

Newsletter

The newsletter uses double opt-in: after you enter your address you receive an email with a confirmation link. The legal basis is your consent, Art. 6 (1) (a) GDPR.

You can unsubscribe at any time via the link in any email or by writing to info@shortt.de. Withdrawing consent does not affect the lawfulness of processing before the withdrawal.

Maps and external services

Tour pages show a route map built with Mapbox (Mapbox Inc.). When the map loads, your IP address and the requested map tiles are transmitted to Mapbox. The legal basis is Art. 6 (1) (f) GDPR, our legitimate interest in showing the route clearly.

Links to our Telegram, Instagram and TikTok profiles are ordinary links: data is transmitted to those platforms only after you follow them.

Analytics

We collect visit statistics only after your consent in the cookie banner. The legal basis is Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. You can withdraw consent at any time through the cookie settings at the bottom of the page.

Details about stored files and their lifetimes are in the Cookies section.

Recipients of data

Data processing agreements under Art. 28 GDPR are in place with our processors. Some services are located outside the EU; transfers are covered by the European Commission's standard contractual clauses.

• Vercel Inc. — website hosting
• Supabase — database of requests and orders
• Stripe Payments Europe, Ltd. — payment processing
• Resend — sending emails
• Mapbox Inc. — map display
• Our bank and tax adviser — to the extent required for bookkeeping

Your rights

An email to info@shortt.de is enough to exercise these rights.

You also have the right to lodge a complaint with a supervisory authority. For our company this is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

• access to information about the processing of your data (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to processing based on legitimate interest (Art. 21 GDPR)
• withdrawal of consent given earlier