1. Controller

The controller responsible for the processing of personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:

2. General Information on Data Processing

The protection of personal data is important to us. Personal data is processed on Tourexpi only insofar as this is necessary for the operation of the website and the services offered, an appropriate legal basis exists, or users have consented to the processing.

Personal data means any information relating to an identified or identifiable natural person.

Personal data is processed in particular on the basis of Article 6(1) GDPR. Where processing is based on consent, the legal basis is Article 6(1)(a) GDPR. Consent may be withdrawn at any time with effect for the future.

3. Hosting and Server Operation

Tourexpi is hosted on a Virtual Dedicated Server (VDS) operated by ITC Baraner. The server is rented from Turhost and is physically located in the Netherlands.

When the website is accessed, technically necessary data may be processed and stored in server log files. This may include, in particular, the IP address, date and time of access, page or file requested, amount of data transferred, referrer URL, browser and browser version, operating system, and access status or HTTP status code.

This processing serves in particular to provide and maintain the technical stability of the website, ensure system security, analyse errors, and detect and prevent abusive or unlawful access.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and functional operation of our online service.

The server is located within the European Union.

4. Cookies and Similar Technologies

Tourexpi uses cookies and similar technologies. Cookies are small data records stored on a user's device or used to access information already stored on that device.

Technically necessary cookies and similar technologies may be used where required for the operation and basic functions of the website.

For technologies that are not technically necessary, in particular technologies used to analyse user behaviour, consent is obtained before use where required by law.

Users can manage their consent decisions through the consent management platform used on Tourexpi and can change or withdraw consent at any time with effect for the future.

5. Consent Management with Usercentrics

We use the Consent Management Platform (CMP) of Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany, to manage and document consent.

Usercentrics enables us to provide information about services used on the website and to record and document users' decisions regarding technologies requiring consent.

Data processed may include, in particular, information on consent granted or refused, consent IDs, the time and type of decision, device and browser information, HTTP referrer and IP address.

The processing is necessary to manage and demonstrate consent decisions. Where processing is necessary to comply with statutory documentation obligations, it is based on Article 6(1)(c) GDPR. Where there is an additional legitimate interest in legally compliant and transparent consent management, processing may be based on Article 6(1)(f) GDPR.

Users can review and change their consent decisions for the future at any time through the privacy settings on Tourexpi.

6. Google Analytics

Tourexpi uses Google Analytics for statistical analysis of website use. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics enables us to evaluate information about how visitors use Tourexpi. This may include information on pages viewed, the time and duration of visits, technical information about the browser and device, approximate location information and interactions with the website.

Google Analytics is used on the basis of consent pursuant to Article 6(1)(a) GDPR. Where consent is required for storing information on a device or accessing information already stored on a device, the service is likewise used only after the relevant consent has been given.

Consent can be changed or withdrawn at any time with effect for the future through Tourexpi's privacy settings.

When Google services are used, it cannot be ruled out that data may also be processed by Google companies or service providers outside the European Economic Area. Further information on the services used and any data transfers can be found in the relevant privacy information or consent settings.

7. Newsletter

Tourexpi offers a free newsletter.

We use a double opt-in procedure for newsletter subscriptions. After an email address is entered, a confirmation message is sent to that address. The subscription becomes effective only after it has been confirmed through that message.

The email address is processed for newsletter delivery on the basis of consent pursuant to Article 6(1)(a) GDPR.

Consent to receive the newsletter may be withdrawn at any time with effect for the future, in particular by using the unsubscribe option included in every newsletter.

After unsubscribing, the email address is removed from the active newsletter distribution list unless another legal basis requires continued storage.

Data required to demonstrate that consent was properly obtained may also be retained in accordance with applicable limitation periods and documentation obligations.

8. Newsletter Delivery via SMTP2GO

The newsletter is managed using software developed by Tourexpi. We use the SMTP2GO delivery service for the technical transmission of emails.

For delivery, the newsletter recipient's email address is transmitted to SMTP2GO. According to the technical information available to us, Tourexpi does not transmit names, IP addresses or other personal data to SMTP2GO for this purpose.

The processing is carried out for the technical delivery of the newsletter requested by the user and is therefore directly connected with the consent-based newsletter service.

9. No Newsletter Open Tracking

Tourexpi does not directly measure whether a recipient has opened a newsletter.

In particular, according to the technical information available to us, no recipient-specific open tracking using tracking pixels within the newsletter is performed.

10. Newsletter Clicks and Internal Access Statistics

Newsletters contain links to content on Tourexpi.

When a recipient clicks such a link, the relevant page on Tourexpi is opened. Like other visits to Tourexpi, this page view may be recorded in the website's internal log or statistics system.

The data collected is used in particular for the technical provision of the requested content and for statistical analysis of the use of Tourexpi.

This does not constitute direct measurement of whether the newsletter itself was opened.

11. Contact by Email or Telephone

If users contact us by email or telephone, we process the personal data transmitted in this context insofar as necessary to deal with the respective enquiry.

Depending on the subject of the enquiry, processing is based on Article 6(1)(b) GDPR where the contact relates to entering into or performing a contract, or on Article 6(1)(f) GDPR. In the latter case, our legitimate interest is the appropriate handling of communications addressed to us.

12. External Media

Tourexpi has used YouTube and Vimeo integrations in the past. These functions are currently disabled.

As long as these services are not actively embedded in the website and no connection to the respective providers is established when Tourexpi is visited, no corresponding data transfer takes place through such integrations.

If external media or comparable services are activated again in the future, the privacy information and consent configuration will be updated accordingly.

13. Storage Period

Personal data is generally stored only for as long as necessary for the respective processing purpose.

Data may also be retained where statutory retention, documentation or limitation periods require this.

When the purpose of processing ceases to apply and there is no statutory or other legal basis for continued storage, the relevant personal data will be deleted.

14. Recipients of Personal Data

Personal data may be transmitted to technical service providers insofar as this is necessary for operating the website or providing the relevant services.

Depending on the service used, these may include providers of server infrastructure, consent management, web analytics and email delivery.

Where service providers process personal data on our behalf, this is carried out in accordance with applicable data protection requirements.

15. Transfers to Third Countries

Some of the service providers we use, or their subcontractors, may process personal data outside the European Union or the European Economic Area.

Where such a transfer takes place, it is carried out only in accordance with the requirements of Articles 44 et seq. GDPR, for example on the basis of an adequacy decision of the European Commission or appropriate safeguards such as the European Commission's Standard Contractual Clauses.

16. Rights of Data Subjects

Subject to the statutory requirements, data subjects have in particular the right of access (Article 15 GDPR), rectification (Article 16 GDPR), erasure (Article 17 GDPR), restriction of processing (Article 18 GDPR), data portability (Article 20 GDPR), objection (Article 21 GDPR), and the right to withdraw consent at any time with effect for the future pursuant to Article 7(3) GDPR.

To exercise these rights, data subjects may contact baraner@baraner.com.

17. Right to Object

Where we process personal data on the basis of legitimate interests under Article 6(1)(f) GDPR, data subjects have the right, subject to the statutory requirements, to object to the processing on grounds relating to their particular situation.

18. Right to Lodge a Complaint

Under Article 77 GDPR, data subjects have the right to lodge a complaint with a data protection supervisory authority if they consider that the processing of their personal data infringes the GDPR.

The supervisory authority generally responsible for the controller is: The State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate (Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz), Hintere Bleiche 34, 55116 Mainz, Germany.

The right to contact another competent supervisory authority in accordance with applicable law remains unaffected.

19. Security

We take appropriate technical and organisational measures to protect personal data against loss, manipulation, unauthorised access and other risks.

Security measures are reviewed in line with technological developments and existing risks and are adjusted where necessary.

20. Amendments to this Privacy Policy

This Privacy Policy may be amended if the technical functions of Tourexpi, the services used or the legal requirements change.

The version currently published on Tourexpi applies.

Last updated: September 2026