Privacy Policy
Last updated: February 15, 2026
Table of Contents
1. Data Controller
The data controller responsible for your personal data is:
Legal Entity: [LEGAL_ENTITY_NAME]
Address: [REGISTERED_ADDRESS]
Contact Email: [CONTACT_EMAIL]
Data Protection Officer (DPO): [DPO_EMAIL]
2. Categories of Personal Data We Collect
a) Account Data
Full name, email address, password (encrypted), user role (organizer/hiker).
b) Profile Data
Profile picture, bio, phone number, certifications, years of experience, social media links.
c) Booking Data
Trip details, number of people, special requirements, booking status.
d) Technical Data
IP address, browser type, device information, cookies, usage analytics.
3. Purposes of Processing and Legal Basis
| Purpose | Legal Basis |
|---|---|
| Account creation and management | Performance of contract (GDPR Art. 6.1.b) |
| Processing trip bookings | Performance of contract (GDPR Art. 6.1.b) |
| User communication (notifications, support) | Legitimate interest (GDPR Art. 6.1.f) |
| Platform usage analytics (Google Analytics) | Consent (GDPR Art. 6.1.a) |
| Compliance with legal obligations | Legal obligation (GDPR Art. 6.1.c) |
⚠️ For non-essential cookies (e.g., analytics), we will request your consent before using them. Consent is not implied by continued browsing.
4. Recipients or Categories of Recipients
Your personal data may be disclosed to the following categories of recipients:
- Hosting service providers
- Analytics services (e.g., Google Analytics)
- Email service providers (e.g., Resend, SendGrid)
- Payment processors (if applicable)
- Legal advisors and auditors
- Public authorities (upon lawful request)
5. International Data Transfers
Some of our service providers (e.g., Google Analytics) may process data outside the European Economic Area (EEA).
When we transfer data internationally, we implement appropriate safeguards such as:
- European Commission adequacy decisions
- Standard Contractual Clauses (SCCs)
- Certifications such as the EU-U.S. Data Privacy Framework
6. Data Retention Period
We retain your personal data only for as long as necessary for the purposes collected:
- Account data: Until you delete your account or 3 years of inactivity
- Booking data: 5 years for accounting/legal purposes
- Technical data (analytics): 14 months (per Google Analytics settings)
- Server logs: Up to 90 days
7. Your Data Subject Rights
Under GDPR, you have the following rights:
✓ Right of Access (Article 15)
Request a copy of your personal data and information about how we process it.
✓ Right to Rectification (Article 16)
Correct inaccurate or incomplete personal data.
✓ Right to Erasure / "Right to be Forgotten" (Article 17)
Request deletion of your data under certain conditions.
✓ Right to Restriction of Processing (Article 18)
Restrict how we process your data under certain circumstances.
✓ Right to Data Portability (Article 20)
Receive your data in a structured, machine-readable format.
✓ Right to Object (Article 21)
Object to processing based on legitimate interests or direct marketing.
✓ Right to Withdraw Consent
Withdraw your consent at any time (e.g., for analytics cookies). Withdrawing consent is as easy as giving it.
✓ Right to Lodge a Complaint
Lodge a complaint with the competent supervisory authority:
Authority: [SUPERVISORY_AUTHORITY_NAME]
Website: [SUPERVISORY_AUTHORITY_URL]
📧 To exercise any of these rights, contact us at [CONTACT_EMAIL]
8. Automated Decision-Making and Profiling
We do not use automated decision-making or profiling that produces legal or similarly significant effects concerning you.
9. Data Security
We implement appropriate technical and organizational measures to protect your data, including:
- Data encryption (HTTPS/TLS)
- Encrypted passwords (hashing)
- Access controls and authorization
- Regular security monitoring
10. Contact Us
For any questions about this Privacy Policy or the processing of your data, please contact us:
Email: [CONTACT_EMAIL]
Data Protection Officer: [DPO_EMAIL]
⚠️ Mandatory Provision of Data
The provision of certain personal data (name, email) is necessary for account creation and use of the platform. If you do not provide this data, we will not be able to provide our services to you.