How we use data

How we use data

Privacy Policy – TREKZ Travel Solutions GmbH

Effective: September 2026

1. Controller

TREKZ Travel Solutions GmbH

Bahnhofstr. 2a, 82296 Schöngeising, Germany

E-mail: privacy@trekz.io | Website: www.trekz.io

Represented by the managing director Jörg Burtscheidt

2. Principles of Data Processing

We process personal data solely in accordance with the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). Processing purposes include:

  • performance and fulfilment of travel and event contracts

  • communication with customers, partners, creators and service providers

  • fulfilment of legal obligations (e.g. tax and commercial retention duties)

  • direct marketing of similar in-house services where permitted by law

  • preparation and execution of required entry, security and check-in procedures by service providers (e.g. airlines, hotels, DMCs); passport/ID data of travellers are transmitted for this purpose where necessary

  • delivery of experiences offered in cooperation with media and cooperation partners (see sections 6 and 7)

3. Categories of Data Processed

  • Master data: name, address, contact details, date of birth

  • Contract data: booking and payment information, travel details

  • Communication data: e-mails, chat or contact-form enquiries

  • Marketing data: newsletter subscriptions, consents and consent records

  • Usage data: access to our website and booking flow, strictly necessary cookies, IP address

  • Travel document data: passport number, issuing country, expiry date (where necessary for the performance of the trip)

4. Legal Basis

  • Art. 6(1)(b) GDPR – performance of a contract or pre-contractual measures

  • Art. 6(1)(a) GDPR – consent (e.g. newsletter, transfer to cooperation partners for marketing purposes)

  • Art. 6(1)(c) GDPR – legal obligations

  • Art. 6(1)(f) GDPR – legitimate interests (e.g. IT security, operation of the booking flow, direct marketing to existing customers)

5. Data Recipients

Data are shared only where necessary for the performance of the contract, where you have consented, or where required by law. Recipients may include:

  • service providers of the respective trip (hotels, local agencies, airlines, event organisers, transport companies)

  • technical providers processing on our behalf: booking technology and travel management, payment processing, flight ticketing, customer service, e-mail delivery and website hosting. Data processing agreements under Art. 28 GDPR are in place with these providers

  • media and cooperation partners for jointly offered experiences (see section 6)

  • insurance companies, banks, public authorities or tax advisors

6. Experiences Offered with Media and Cooperation Partners

Some experiences are offered in cooperation with a media or cooperation partner under whose brand the experience is marketed. The partner for a given experience is named in the respective trip description and in the overview below. In all cases, TREKZ Travel Solutions GmbH remains the tour operator and your contractual partner.

For such experiences we share data with the partner in two situations:

For the delivery of the experience, the partner receives the salutation, first name and surname of the participants so that the partner's accompanying staff and the host can look after you on site. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR). The partner uses these data solely for the delivery of the experience and deletes them after it has ended.

Only with your separate consent given during the booking process do we share your salutation, name, e-mail address and, where stated in the consent, your postal address with the partner so that the partner can inform you about its own offers. The partner processes these data as an independent controller under its own privacy notice. Your consent is voluntary, the booking does not depend on it, and you may withdraw it at any time towards us (privacy@trekz.io) or towards the partner. Processing carried out before withdrawal remains lawful.

Partner overview

Partner

Brand / experiences

Partner's privacy notice

FUNKE Women, People & Family GmbH, Großer Burstah 18–32, 20457 Hamburg, Germany

GALA – GALA Royal Experiences

LINK TO GALA.DE PRIVACY NOTICE

7. Joint Controllership for Embedded Booking Flows

For experiences offered with a media or cooperation partner, our booking flow may be embedded on the partner's website or apps. For the collection of your data within this embedded booking flow, from the first page view to the completion of the booking, we and the respective partner are joint controllers within the meaning of Art. 26 GDPR. The purpose of the processing is the conclusion of your travel contract with TREKZ (Art. 6(1)(b) GDPR).

We have agreed with the partner that TREKZ is your point of contact for questions and for exercising your rights (privacy@trekz.io), and that TREKZ is responsible for the information duties and the security of the booking flow, while the partner is responsible for the embedding on its pages. You may nevertheless also exercise your rights against the partner. From the completion of the booking onwards, TREKZ processes your data alone. The partners concerned are listed in section 6.

8. Data Transfers to Countries Outside the EU

Where the destination is outside the EU or the EEA, we transfer the data required for the delivery of the trip (in particular name, date of birth, travel document data) to the local service providers such as hotels, agencies and carriers. For countries covered by an adequacy decision of the EU Commission (e.g. the United Kingdom, Switzerland), an adequate level of protection is thereby ensured. For other countries, the transfer takes place because it is necessary for the performance of the travel contract concluded with you (Art. 49(1)(b) GDPR). Those countries may not provide a level of data protection comparable to that of the EU.

9. Cookies

Our website and our booking flow use only strictly necessary cookies and similar technologies required for the operation of the site, its security and the completion of the booking process (Section 25(2) TDDDG, Art. 6(1)(f) GDPR). We currently do not use audience measurement or marketing tracking. Should we introduce such technologies in the future, we will obtain your consent beforehand.


10. Storage Period

We retain contract, booking and payment data for the duration of the statutory commercial and tax retention periods (generally six or ten years). We delete travel document data after the completion of the trip and the related transmission and reporting obligations. Names transferred to cooperation partners for the delivery of an experience are deleted after the experience has ended. Data processed on the basis of your consent are stored until you withdraw it; we retain the record of consent beyond that for as long as claims could be asserted from it. Otherwise, we delete data as soon as the purpose ceases to apply.

11. Your Rights

You have the right at any time to

  • access (Art. 15 GDPR)

  • rectification (Art. 16 GDPR)

  • erasure (Art. 17 GDPR)

  • restriction of processing (Art. 18 GDPR)

  • data portability (Art. 20 GDPR)

  • objection (Art. 21 GDPR, in particular against direct marketing)

  • withdrawal of consent (Art. 7(3) GDPR)

To exercise your rights, please contact privacy@trekz.io. You may also lodge a complaint with the competent supervisory authority (e.g. the Bavarian State Office for Data Protection Supervision).

12. Data Security

TREKZ applies technical and organisational measures to protect personal data against loss, misuse and unauthorised access. These measures are reviewed regularly in line with technological developments.

13. Changes to this Policy

We reserve the right to amend this privacy policy to reflect changes in the law or new services. The version published on our website applies.