Privacy Policy

1. Controller

The controller for the processing of data on this website within the meaning of Art. 4(7) GDPR is:

Serhii D.
Sumy, Ukraine
Email: moc.liamg@ed.moc.msiruot
We are not reachable by phone; all contact happens by email only.

Further details about the operator can be found in the legal notice. For any question about data protection, and for access, erasure and objection requests, an email to moc.liamg@ed.moc.msiruot is enough.

2. Overview

This website is an editorial travel publication. You can read it without signing up and without giving away any information about yourself. There are no reader accounts, no comment function and no contact form.

Personal data arises when you open a page (technically unavoidable), when we measure the reach of our articles, when you click an affiliate link labeled "Ad", when Google AdSense ads are served on a page, when a page contains embedded third-party content, and when you sign up for the newsletter or write to us. Each of these cases is described separately below: what data, for what purpose, on what legal basis and for how long.

Section 6 summarizes how you can object to the individual processing operations or prevent them by technical means. What we describe here is the actual state of the website, not a state we are still working towards.

3. Opening the website: hosting and server log files

The website runs on a rented server at Hetzner Online GmbH, Germany. Every time a page is opened, your browser transmits technically necessary data, which the server stores in log files:

• IP address of the requesting device,
• date and time of the request,
• the address requested and the volume of data transferred,
• status code of the response,
• the page visited previously (referrer), if your browser transmits it,
• browser type, browser version and operating system.

The purpose is technical operation, delivery of the page, stability, and the detection and prevention of attacks and misuse. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and trouble-free operation of the website. This log data is not combined with other data sources. Log files are deleted after 12 months.

A data processing agreement under Art. 28 GDPR is in place with the provider of the server infrastructure.

4. Content delivery network and attack protection (Cloudflare)

The website sits behind the Cloudflare content delivery network. Cloudflare serves static content from a data center near you, filters out automated attacks and encrypts the connection. For this to work, every request to this website technically passes through Cloudflare's servers first, and they process your IP address, the address requested and details of your browser and device.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the security and loading speed of the website. Cloudflare acts as our processor. Processing in third countries, in particular in the United States, cannot be ruled out; it is based on the European Commission's standard contractual clauses. Further details: Cloudflare's privacy policy.

5. Cookies and storage on your device

Cookies are small text files that a website places on your device. The browser stores "localStorage" and "sessionStorage" work in a comparable way. We set as few cookies of our own as possible, and we do not use retargeting pixels of our own. Cookies that can recognize you across other websites do arise, however, through the Google AdSense ads (section 9) and through embedded third-party content (section 10).

Technically necessary (§ 25 Abs. 2 Nr. 2 TDDDG, Art. 6(1)(f) GDPR):

Not necessary; we set them without asking beforehand, on the basis of Art. 6(1)(f) GDPR:

pl_vid is only set when you click an affiliate link or an advertising slot, not while you are merely reading. The audience measurement and ad delivery cookies, by contrast, are created on every page view as soon as the corresponding scripts have loaded, unless you prevent that; section 6 explains how.

We also set cookies for logged-in members of the editorial team (sign-in to the editing interface, preview of unpublished articles). As a reader, you never encounter these cookies.

You can delete cookies in your browser at any time and prevent new ones from being set. If you block technically necessary cookies, some convenience features will stop working.

6. Cookie notice and your options

On your first visit you see a notice at the bottom of the screen telling you that this website uses cookies, with a button to confirm and a link to this page. So that you know where you stand, we describe openly what this notice does and what it does not do.

• The notice informs. It is not a consent dialog with categories and it has no "Reject" button.
• If you confirm it, the value gdpr-accepted is stored in your browser storage so that the notice does not reappear on every visit. It stays there until you delete this site's data in your browser.
• Audience measurement, the ads and embedded content do not depend on that button. They are loaded whether you confirm the notice, dismiss it or ignore it. We base them on a legitimate interest (sections 7, 9 and 10) and not on consent.
• No consent management platform, no consent categories and no Google Consent Mode are in use on this website.

How to prevent the processing effectively:

• Audience measurement: Google's opt-out add-on for common browsers, tools.google.com/dlpage/gaoptout. It works on every website that uses Google Analytics.
• Advertising: whether Google shows you personalized ads is something you set in your Google account at myadcenter.google.com. The setting works on every website that serves ads from Google. If you switch personalization off there, you still see ads, but without any selection based on your interests.
• Cookies in general: in your browser settings, block third-party cookies and, if you wish, first-party cookies for this domain as well, or have them deleted automatically when you close the browser. A private window achieves the same for the duration of the session.
• Scripts and embedded content: a content blocker or a browser with built-in tracking protection already prevents the scripts of Google and of the embedded providers from loading. The editorial content of this website remains fully readable.
• Objection: you can object under Art. 21 GDPR to any processing that we base on a legitimate interest. An informal email to moc.liamg@ed.moc.msiruot is enough; we will then delete the click data stored about you (section 8).

Where we actually do obtain your consent, we say so explicitly. On this website that concerns only the newsletter sign-up (section 11).

7. Audience measurement with Google Analytics 4

We use Google Analytics 4, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The service helps us understand which articles get read, which search terms bring readers to us and where they drop off.

The measurement script is loaded only after the page has finished building, at your first movement on the page or a few seconds later at the latest. If you leave the page before that, your browser sends a single, very small message about the page view to Google and stores the identifier named below in the process; without that message, short visits would be missing from the statistics entirely. No measurement takes place for logged-in members of the editorial team or for automated measurement tools.

The data processed includes: a randomly assigned identifier in the _ga cookie with a lifetime of up to two years, your IP address, which Google states it shortens before storage, the pages opened and time spent on them, approximate location at country or region level, device type, screen resolution, browser language and the page visited previously. We have not configured any additional IP anonymization separately; it can no longer be set in Google Analytics 4.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in recognizing what our readers need and shaping the articles accordingly. We do not obtain prior consent for this. That assessment is the legal position of the operator; as regards access to your device, the view is also taken that consent under § 25 Abs. 1 TDDDG (the German provision on storing information on, and accessing, a user's device) is required. Section 6 explains how to switch the measurement off for yourself.

The data is also processed on servers of Google LLC in the United States; this is based on the standard contractual clauses and on Google's certification under the EU-US Data Privacy Framework. We have concluded a data processing agreement with Google. The storage period in Google Analytics is 14 months.

Microsoft Clarity. With your consent we also use Microsoft Clarity, a service of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Clarity records how pages are used (clicks, scrolling and mouse movements) and builds heatmaps and session recordings from this, which helps us spot usability problems. The script is loaded only after you have agreed in the cookie notice; without consent, or after you decline, it is not loaded. Clarity sets the cookies _clck (up to one year) and _clsk (one day) and processes your IP address and details of your browser and device. The legal basis is your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG; you can withdraw it at any time via the cookie settings link in the footer of the website. Microsoft also processes the data in the United States; see section 16. Further information: privacy.microsoft.com/privacystatement.

8. Affiliate links, redirects and click tracking

This website is funded by affiliate commissions. Links and blocks that can earn us a commission are labeled "Ad". We describe this in detail on the page How we make money.

What happens technically. Affiliate links first point to an address on our own domain, for example tourism.com.de/go-hotel. From there our server redirects you to the provider by HTTP redirect and attaches an identifier that credits the click to our website. This identifier contains the short name (slug) of the article you clicked from, so that we can see which articles are useful. It contains no details about you as a person. The redirect page itself is not cached and is not indexed by search engines.

What we store in the process. When you click such a link, we store the following in our own database: the link clicked, the IP address in full, unshortened form, a random identifier from the pl_vid cookie, the browser family and operating system in rough form, the page you clicked from, the address requested, the article identifier mentioned above, whether it was your first click, plus the date and time. The purpose is to check the accounting against the affiliate programs and to work out which recommendations our readers actually need.

The legal basis for setting the pl_vid cookie and for storing the click data is Art. 6(1)(f) GDPR; our legitimate interest lies in verifying commission statements and in running the website as a business. We do not obtain prior consent for this; the note in section 7 applies here as well. We store the click data for no longer than twelve months from the click; after that it is deleted. Within that period we delete it as soon as the accounting with the affiliate program concerned has been completed and checked. If you object under Art. 21 GDPR, we delete the entries relating to you earlier.

What the partner learns. After the redirect, your browser connects to the provider itself. The provider receives your IP address, details of your browser and device and the attached identifier, and it usually sets a cookie of its own so that a later booking can be credited to us. We do not transmit the full path of the article you clicked from; the provider only sees our domain as the source. We have no influence over that processing; the privacy policy of the provider concerned applies. A booking contract is concluded exclusively between you and the provider.

We currently work with the following partners and networks: GetYourGuide (tours and tickets), Trip.com (hotels), Kiwitaxi (transfers), Discover Cars (rental cars), Omio (rail and coach), AirHelp (air passenger rights), Yesim (eSIM), and the networks Travelpayouts, Awin and CJ Affiliate. Some of these providers are based outside the European Union; see section 16.

9. Advertising on this website: our own slots and Google AdSense

Our own advertising slots. On some pages we show our own advertising slots with recommendations. If you click such a slot, we store the same details as described in section 8, plus the identifier of the slot; here too the pl_vid cookie is set if it is not already there. The legal basis, the right to object and the storage period are the same as in section 8.

Google AdSense. In addition, we have ads served through Google AdSense, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. For this, your browser loads a script from Google (pagead2.googlesyndication.com) that fills the advertising slots. The script is not loaded straight away with the page, but only once you start using the page, that is at the first scroll and with a short delay after that. It is not loaded for logged-in members of the editorial team or for automated measurement tools.

As soon as the script has loaded, Google receives your IP address, details of your browser, device and screen and the address of the page the ad sits on, and it sets cookies of its own, including __gads and __gpi, or reads existing ones. Google uses this information to select and deliver ads, to measure their display, to detect click fraud and to make the accounting with us possible. Whether the ads are personalized on the basis of your interests depends on the settings in your Google account; we have not set an option that would allow only non-personalized ads on this website in general. We ourselves receive from Google only aggregated reports on impressions, clicks and revenue, and no details about individual people.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in funding the freely accessible editorial publication. We do not obtain prior consent for this; the same note applies as in section 7, according to which, as regards access to your device, the view is also taken that consent under § 25 Abs. 1 TDDDG is required. No consent management platform is in use on this website (section 6); Google's policy on EU user consent provides for a consent platform certified by Google, which is the responsibility of the operator and is being reviewed.

Google also processes the data on servers in the United States; see section 16. Further details are available in Google's privacy policy and under How Google uses data for advertising. You manage your advertising settings at Google, including personalization, at myadcenter.google.com; section 6 explains how to prevent the ads beyond that.

10. Embedded third-party content

Articles may contain embedded videos, maps and posts from social networks. Such content is loaded together with the page it sits on. There is currently no preview area that you have to release first (two-click solution). As soon as you open a page with embedded content, the provider concerned receives your IP address, details of your browser and device and the address of the page the content is embedded in, and it can set its own cookies. If you do not want that, a content blocker helps; see section 6.

• YouTube, Google Ireland Limited: embedded via extended privacy mode (youtube-nocookie.com). Google states that it sets cookies only when playback starts, but it receives your IP address as soon as the content loads.
• Vimeo, Vimeo.com Inc., United States.
• Google Maps, Google Ireland Limited: embedded as a map directly in the page. When you open a page with a map, Google receives your IP address and can set cookies. Further details: Google's privacy policy.
• Spotify, Spotify AB, Sweden.
• X (Twitter), Instagram, Facebook, TikTok, CodePen: only where a post is explicitly quoted.
• Partner widgets from travel providers, such as search and booking forms: these are likewise loaded with the page.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in being able to show maps, videos and booking forms right next to the relevant article. The note in section 7 applies here as well.

11. Newsletter

You can sign up for our newsletter. The only mandatory detail is your email address; without an explicitly ticked consent box the sign-up is not stored. We also store the language version, the page you signed up from, the time of your consent and the version of the consent text; we need this to be able to demonstrate the consent. We do not store an IP address at sign-up.

As of today we do not yet send a newsletter. No sending service is connected, and no confirmation email goes out to you either. Your sign-up is therefore stored as "unconfirmed" and sits unused. Before the first newsletter is sent, we will introduce a confirmation procedure and update this policy accordingly; unconfirmed sign-ups will then not be contacted.

The legal basis is your consent under Art. 6(1)(a) GDPR. You can withdraw it at any time with effect for the future. As long as no newsletter is being sent, there is no automatic unsubscribe link for this: an informal email to moc.liamg@ed.moc.msiruot is enough and we delete your address. Once sending begins, every email will contain an unsubscribe link.

We do not pass newsletter addresses on to third parties and use them solely to send the newsletter.

12. Contacting us by email

There is no contact form on this website. If you write to us, we process your email address, your name if you give it, and the content of your message in order to answer your enquiry.

The legal basis is Art. 6(1)(f) GDPR where it concerns answering a general enquiry, or Art. 6(1)(b) GDPR where your enquiry is aimed at a contract. We keep the correspondence for as long as it is needed for follow-up questions and delete it afterwards, unless statutory retention obligations prevent this.

Please note that emails are sent unencrypted unless you use encryption of your own. Do not send us particularly sensitive information by email.

13. Statistical counters on the website

We count how often an article has been opened, shared or bookmarked, and we display these totals. In doing so, we store only a counter attached to the article, no details about the individual reader. To limit manipulation and automated access, the server briefly processes a check value calculated from the IP address, browser identifier and language. This value is held in memory only, discarded after one minute at the latest, and never stored.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in meaningful counters and in protection against misuse.

14. Log of pages not found

If a browser requests an address that does not exist on this website, we store the address requested, the page visited previously and the browser identifier, in order to find broken links and set up redirects. We do not store the IP address; addresses are stripped of any credentials and email addresses before storage.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in keeping the website free of errors. We delete the entries as soon as the error concerned has been fixed or the entry is no longer needed for troubleshooting; no automatic deletion period is set up for this.

15. Fonts, images and static files

Images, icons and other static files are served from our own server. Fonts are downloaded once and likewise served by us. If no local copy exists yet for a newly selected font, your browser fetches the font file from Google Fonts (Google Ireland Limited) instead; your IP address is transmitted to Google in the process. The legal basis in that case is Art. 6(1)(f) GDPR; our legitimate interest lies in the legible and consistent presentation of the page.

16. Recipients and transfers to third countries

We pass on personal data only where this is necessary for the purposes described. The recipients are:

• the provider of the server infrastructure (Hetzner Online GmbH, Germany) as a processor,
• Cloudflare as a processor for delivery and attack protection,
• Google Ireland Limited for audience measurement, for serving ads via Google AdSense and, in the fallback case under section 15, for serving fonts,
• providers of embedded content, as soon as you open a page containing such content,
• travel providers and affiliate networks, as soon as you click an affiliate link and thereby open their website yourself.

The operator of this website is based in Ukraine. The European Commission has not issued an adequacy decision for Ukraine. Processing by us is therefore carried out on the basis of appropriate safeguards or, where it is necessary to deal with your enquiry, under Art. 49(1) GDPR.

Some of the recipients named above process data outside the European Union, including in the United States, Singapore and Hong Kong. Where there is no adequacy decision for the country concerned, we base the transfer on the European Commission's standard contractual clauses. Third countries may offer a level of protection that does not match the European one, in particular as regards access by state authorities and the enforcement of your rights.

17. Storage period

We store personal data only for as long as it is needed for the purpose concerned, or for as long as statutory retention periods apply. The specific periods are given in the relevant section; where no fixed period is set up, we say so explicitly. After that we delete the data or anonymize it so that it can no longer be traced back to you.

18. Your rights

You have the following rights in relation to us:

• Access (Art. 15 GDPR): you can find out whether we process data about you and what that data is.
• Rectification (Art. 16 GDPR): you can have inaccurate data corrected.
• Erasure (Art. 17 GDPR): you can request the erasure of your data, unless a retention obligation stands in the way.
• Restriction of processing (Art. 18 GDPR).
• Data portability (Art. 20 GDPR): you receive the data you provided to us in a common machine-readable format.
• Objection (Art. 21 GDPR): you can object at any time to processing that we base on a legitimate interest. This applies in particular to the audience measurement under section 7, the click tracking under section 8 and the serving of ads under section 9.
• Withdrawal of consent (Art. 7(3) GDPR): at any time with effect for the future, without giving reasons. This concerns the newsletter sign-up.

For all of these matters, an informal message to moc.liamg@ed.moc.msiruot is enough. We reply without undue delay, within one month at the latest. To match your request to a person we may need to ask a follow-up question; we do not ask for additional identity documents.

19. Right to lodge a complaint

You have the right to complain to a data protection supervisory authority about the processing of your personal data, in particular to the authority in your habitual residence, your place of work or the place of the alleged infringement. An overview of the German supervisory authorities is available from the Federal Commissioner for Data Protection and Freedom of Information.

20. No obligation to provide data, no automated decisions

You are not obliged to provide us with personal data. You can read the content of this website without giving any details at all. Without an email address, only the newsletter is unavailable.

Automated decision-making under Art. 22 GDPR that produces legal effects concerning you does not take place. We ourselves do not build personality profiles and we do not sell data; whether Google draws on profiles to select the ads depends on the settings in your Google account (section 9).

21. Changes to this policy

We adapt this privacy policy when the technology of the website, the services used or the legal situation change. The version published here is the one that applies.

Last updated: 10.10.2026

The legally binding version of this page is the German one.