Data Protection Policy

Privacy Policy – Bookiply Holidays GmbH


Introduction and General Information

Thank you for your interest in our website. The protection of your personal data is very important to us. In the following, you will find information on the handling of your data collected through your use of our website as well as information on the handling of your data if you are a customer, interested party or business partner. Your data will be processed in accordance with the legal regulations on data protection.


Person Responsible within the Meaning of the GDPR

Bookiply Holidays GmbH
Avenida Perfecto Palacio de la Fuente 1
03003 Alicante, Spain

E-Mail: service@bookiply-holidays.com


Contact Details of the Data Protection Officer

Proliance GmbH / www.datenschutzexperte.de
Leopoldstr. 21
80802 Munich

E-Mail: datenschutzbeauftragter@datenschutzexperte.de

When contacting the Data Protection Officer, please state the company to which your enquiry relates. Please refrain from enclosing sensitive information, such as a copy of an ID card, with your request.


Definitions

Our privacy policy is intended to be simple and understandable for everyone. In this privacy policy, the official terms of the General Data Protection Regulation (GDPR) are generally used. The official definitions are explained in Art. 4 GDPR.


Access to and Storage of Information in Terminal Equipment

By using our website, information (e.g. IP address) may be accessed or stored (e.g. cookies) in your terminal equipment. With this access or storage, further processing of personal data within the meaning of the GDPR may be associated.

Where this is technically necessary for the error-free provision of our services, the legal basis is § 25 para. 1 sentence 1, para. 2 no. 2 TTDSG.
For all other purposes (e.g. personalised website design), this will only take place with your consent in accordance with Art. 6 para. 1 lit. a GDPR. Consent can be revoked at any time with future effect.


Web Hosting

This website is hosted by an external service provider (Amazon Web Services, Ireland). Personal data collected via our website (e.g. IP addresses, contact requests, communication data, usage data) is stored on the host’s servers.

The processing of this data is necessary to ensure the technical stability and availability of our website. The legal basis is Art. 6 para. 1 lit. f GDPR (legitimate interest).

We have concluded an order processing contract with AWS in accordance with Art. 28 GDPR.


Server Log Files

When you visit our website, the following data is stored temporarily for technical reasons:

  • Date, time and duration of the request

  • Name of the requested file

  • Page from which the file was requested

  • Access status

  • Web browser and operating system used

  • (Complete) IP address of the requesting computer

  • Amount of data transferred

  • Http-referrer and http-method

This information is required to ensure the stability and security of the website. It is deleted or anonymised after 7 days.


Registration (for Hosts)

When registering as a host, we process the following data:

  • First and last name

  • E-mail address

  • Date and time of registration

  • Telephone number

  • Accommodation location

The legal basis is Art. 6 para. 1 lit. a GDPR (consent) or Art. 6 para. 1 lit. b GDPR (contract).

Your account and data will be deleted when you delete your user account, unless statutory retention obligations apply.


Use of Third-Party Services

To provide our services, we use external service providers under GDPR-compliant contracts, including:

  • Zendesk (customer support system)

  • WhatsApp Business (communication)

  • Chekin (guest check-in services)

  • Trustpilot (reviews)

  • Airship (newsletter delivery)

  • Adyen (payment processing)

  • Sentry, Google Analytics, Google Optimize, reCAPTCHA, Google Fonts, Google Maps, Google Tag Manager (analytics, stability, security, and user experience tools)

  • Facebook Pixel & Custom Audiences, Microsoft Advertising, Microsoft Clarity, FullStory, Hotjar, Vimeo (marketing and analytics)

Each service provider either stores data within the EU or provides protection mechanisms such as Standard Contractual Clauses (SCCs) or compliance with the EU-U.S. Data Privacy Framework.

Detailed information about each provider, legal basis, and links to their privacy policies are included in the extended sections.


Cookies

We use cookies for different purposes:

  • Essential cookies (technical necessity) – Art. 6 para. 1 lit. f GDPR

  • Analytics and marketing cookies (with consent) – Art. 6 para. 1 lit. a GDPR

You can manage cookies in your browser settings or revoke consent at any time.


Data Sharing and Recipients

Your personal data is not passed on to third parties unless:

  • explicitly stated in this Privacy Policy,

  • you have given consent (Art. 6 para. 1 lit. a GDPR),

  • required by law (Art. 6 para. 1 lit. c GDPR),

  • necessary for contractual purposes (Art. 6 para. 1 lit. b GDPR), or

  • justified by legitimate interests (Art. 6 para. 1 lit. f GDPR).


Data Security

We apply appropriate technical and organisational measures (TOMs) in accordance with Art. 32 GDPR, including SSL encryption.


Duration of Storage

We store your personal data only as long as necessary for the purposes stated or in compliance with legal retention periods (e.g. tax or commercial law – 2 to 10 years).


Your Rights under GDPR

You have the following rights under GDPR:

  • Art. 15 GDPR – Right of access

  • Art. 16 GDPR – Right to rectification

  • Art. 17 GDPR – Right to erasure

  • Art. 18 GDPR – Right to restriction of processing

  • Art. 20 GDPR – Right to data portability

  • Art. 21 GDPR – Right to object

  • Art. 7 para. 3 GDPR – Right to withdraw consent

  • Art. 77 GDPR – Right to lodge a complaint with a supervisory authority

To exercise your rights, simply email us at service@bookiply-holidays.com.


Legal Obligations

The provision of personal data for contractual purposes is voluntary. However, without the required data, we cannot enter into or fulfil contracts.


Automated Decision-Making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.


Additional Information for Customers, Hosts, and Business Partners

Personal data is processed for:

  • Contract fulfilment (Art. 6 para. 1 lit. b GDPR)

  • Legal obligations (Art. 6 para. 1 lit. c GDPR)

  • Legitimate interests (Art. 6 para. 1 lit. f GDPR)

  • Based on consent (Art. 6 para. 1 lit. a GDPR)

Data may also be transferred to affiliates, service providers, or public authorities where legally required.


Existing Customer Advertising

We may use your email address for similar product/service advertising, provided you have not objected. You can unsubscribe at any time.


Subject to Change

We reserve the right to update this Privacy Policy in line with legal requirements or service changes. The current version always applies to your visit.

Status of this Privacy Policy: 01.09.2023