Privacy policy

You will find further information about the provider in the legal notice.

What this website does not do

This website sets no cookies, uses no analytics or tracking services (no Google Analytics, no Facebook pixel), loads no external fonts or scripts from third parties and operates no user accounts. All images, scripts and stylesheets come from our host's own server (see below) — with one exception: your browser loads the map sections on the tour pages from OpenStreetMap (see below).

This is not just a statement of intent: the server sends a Content Security Policy that forbids the browser from loading content from third-party servers. The only exception is the map images from OpenStreetMap. If someone were to accidentally add an external font or an analytics tool, your browser would block it.

No cookies, no device storage

This website does not store any information on your device — neither cookies nor entries in local storage, session storage or a browser database. Not even “technically necessary” ones. Consent under § 25 of the German TDDDG is therefore not required.

Maps from OpenStreetMap

On the pages of our tours and the round trip we show a map with the stops of the tour. Your browser loads the map sections (“tiles”) directly from the map server of the OpenStreetMap Foundation, St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom, when you open the page. The software library that displays the map comes from our own server.

• Data transmitted: your IP address, the address of our website as the origin of the request (without the path of the page you opened), browser type and time, and the requested map sections.
• Purpose: displaying the map. We do not receive any data about you from the OpenStreetMap Foundation.
• Legal basis: Art. 6 (1) (f) GDPR — our legitimate interest in showing you the course of a tour clearly.
• Transfer to the United Kingdom: an adequacy decision of the EU Commission exists for the United Kingdom (Art. 45 GDPR).
• Cookies: the map sections are images; the website does not store anything on your device in the process.
• Objection: you can object to the processing under Art. 21 GDPR. Technically, you prevent the loading by not opening the tour pages or by blocking content from tile.openstreetmap.org in your browser; the stops are also listed below the map.

How the OpenStreetMap Foundation handles the data is described in its privacy policy.

Hosting and server log files

This website is hosted by Vercel Inc. (USA). Vercel delivers the pages, images and the video via a worldwide server network and also operates the function that receives the contact form. Vercel acts as our processor under Art. 28 GDPR.

When you open a page, your browser transmits technically necessary data to Vercel, which is stored there in log files:

• the address accessed and the time of access

• the amount of data transferred and the HTTP status code

• browser type and operating system

• IP address

• Legal basis: Art. 6 (1) (f) GDPR — our legitimate interest in delivering the website securely, quickly and without technical errors, and in defending against attacks.

• Transfer to the USA: depending on which server delivers the page, this data may also be processed in the USA. Vercel is certified under the EU-US Data Privacy Framework; an adequacy decision of the EU Commission exists for certified companies (Art. 45 GDPR).

• Storage period: the log files are not combined with other data sources. How long Vercel keeps them is determined by Vercel; we do not analyse them and only use them to find errors.

How Vercel handles the data is described in Vercel's privacy notice.

Contact form

When you write to us using the contact form, we process the details you enter: name, email address, optionally phone number, subject and your message.

• Purpose: solely to answer your enquiry and to handle any tour booking that may result from it.
• Legal basis: Art. 6 (1) (b) GDPR (steps prior to entering into a contract) or (f) GDPR for general enquiries.
• Disclosure: to carry out a tour, we pass on the details needed for its organisation to our tour guide on Bali. No disclosure for advertising purposes takes place.
• Sending: your enquiry is sent as an email to our mailbox. The sending is handled by the eusend service (Bjørnerås Labs, Norway) as our processor under Art. 28 GDPR. eusend processes the message within the EU and deletes the sending logs after 30 days. Open and click tracking is switched off.
• Protection against misuse: so that nobody can use the form on a massive scale, the website keeps your IP address in memory for ten minutes when you submit and counts how many enquiries come from it. The address is not stored permanently and is not sent with your enquiry (Art. 6 (1) (f) GDPR).
• Storage period: we delete your enquiry as soon as it has been dealt with conclusively and no statutory retention periods prevent this.
• Spam protection: the form contains a hidden field that is recognised by programs that fill in forms automatically. No additional data about you is collected in the process, and no external service such as reCAPTCHA is used.

Instead, you can always reach us directly by email or phone — the details are on the contact page.

Links to Facebook and Tripadvisor

The website links to our pages on Facebook and Tripadvisor. These are simple links, not embedded content or “like” buttons: as long as you do not click on them, Facebook and Tripadvisor learn nothing about your visit. Only when you click do their privacy policies apply.

Transfer to Indonesia

To carry out a booked tour, your name and travel details are transmitted to our tour guide in Indonesia. Indonesia is a third country without an adequacy decision of the EU Commission. The transfer takes place under Art. 49 (1) (b) GDPR, because it is necessary for the performance of the contract you have requested. Only what is needed to organise the tour is transmitted.

Your rights

You have the right at any time to access the data stored about you (Art. 15 GDPR), to rectification of inaccurate data (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21).

A short email to the address given in the legal notice is sufficient.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority of your country of residence or that of the controller's registered office is responsible.

Encryption

The website is delivered exclusively via HTTPS. Your entries in the contact form are encrypted in transit.