Privacy policy

1. Controller

The controller responsible for the processing of personal data within the meaning of the General Data Protection Regulation (GDPR) is:

Email: kontakt@shourney.com

shourney.com is a brand of Option Wohlstand GmbH.

No data protection officer has been appointed, as there is no legal obligation to do so under Art. 37 GDPR in conjunction with § 38 BDSG (in particular, fewer than 20 people are constantly engaged in the automated processing of personal data, and our core activity does not involve the large-scale processing of special categories of data).

2. General information on data processing

We process personal data exclusively within the framework of applicable data protection law, in particular the GDPR and the TTDSG.

Personal data means any information relating to an identified or identifiable natural person (e. g. name, email address, IP address).

3. Hosting & technical infrastructure

Our website and platform are operated by the following providers:

• Hetzner Online GmbH
• STRATO AG

Processing takes place predominantly on servers within the European Union. Data processing agreements pursuant to Art. 28 GDPR are in place with these providers.

When you access our website, server log files are processed automatically, in particular:

• IP address
• Date and time of access
• Pages / files accessed
• Browser and operating system information

This processing serves to ensure the security, stability and functionality of the website.

Retention period: max. 14 days. Legal basis: Art. 6 (1) (f) GDPR.

4. Registration & user accounts

Using our platform requires creating a user account. In doing so we process, in particular:

• Email address
• Password (stored only in hashed form)
• Optionally, a name or voluntary profile information
• Uploaded files and content
• Jointly planned trips and travel data

This content is not publicly visible and is accessible only to authorised users (e. g. invited fellow travellers).

After a user account is deleted, personal data is erased within 30 days at the latest, unless statutory retention obligations apply.

Legal basis: Art. 6 (1) (b) GDPR.

5. Use by minors

Our platform is not directed at persons under the age of 16. Within our services we collect and process personal data exclusively from users who have reached the age of 16.

Should we become aware that personal data of persons under 16 has been processed, we will erase that data without undue delay, unless statutory retention obligations prevent this or further processing is necessary on overriding legitimate grounds.

6. Signing in with Google

Users may optionally register or sign in using a Google account. In doing so we receive from Google, in particular:

• Name
• Email address
• A unique Google ID

Using the Google login is voluntary and offered purely for convenience. Registration with an email address is available as an alternative.

This may involve a transfer of personal data to the USA. Such transfers take place on the basis of appropriate safeguards (EU standard contractual clauses and the EU-US Data Privacy Framework).

Legal basis: Art. 6 (1) (a) GDPR (consent).

7. File uploads & collaborative planning

Users may upload files and edit content together with other authorised users. Responsibility for uploaded content lies with the respective users.

We ask that you do not upload special categories of personal data (e. g. health data).

Legal basis: Art. 6 (1) (b) GDPR.

8. Contact form & email contact

When you contact us via the contact form or by email, we process the data you provide solely in order to handle your enquiry.

Legal basis:

• Art. 6 (1) (b) GDPR (pre-contractual / contractual enquiries)
• Art. 6 (1) (f) GDPR (other enquiries)

9. Newsletter (Brevo)

We use Brevo to send our newsletter.

• Sign-up via double opt-in
• Logging of the sign-up time and IP address
• Data processing agreement pursuant to Art. 28 GDPR

Legal basis: Art. 6 (1) (a) GDPR. Consent may be withdrawn at any time.

10. Affiliate marketing

Affiliate links are used on our website. Where cookies or comparable tracking technologies are involved, this happens only with your prior consent.

Legal basis: Art. 6 (1) (a) GDPR and § 25 TTDSG.

11. Tracking & analytics

Legal basis: Art. 6 (1) (a) GDPR.

12. Cookies & consent management

We use:

• Strictly necessary cookies
• Optional analytics, marketing and affiliate cookies

Non-essential cookies are set only with your express consent. Consents are logged and can be withdrawn at any time via the consent tool.

Legal basis: Art. 6 (1) (a) GDPR and § 25 TTDSG.

13. Use of artificial intelligence (OpenAI API)

We use the OpenAI API to provide AI-assisted features.

• Processing takes place only on the user's initiative
• Transmitted content is not used for training purposes
• No automated decisions with legal effect

This may involve a transfer of personal data to the USA. Processing takes place on the basis of EU standard contractual clauses. Despite appropriate safeguards, access to data by US authorities cannot be ruled out.

Legal basis: Art. 6 (1) (b) GDPR.

14. Data backups

Regular backups are made to ensure data integrity. These may contain personal data and are overwritten or deleted within 30 days at the latest.

15. Retention periods

Personal data is stored only for as long as is necessary for the respective purpose or as long as statutory retention obligations apply.

16. Rights of data subjects

Data subjects have the right at any time to:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Object (Art. 21 GDPR)
• Withdraw consent that has been given

There is also a right to lodge a complaint with the competent supervisory authority: the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.

17. Changes to this privacy policy

We reserve the right to amend this privacy policy in order to reflect legal or technical changes.