Privacy Policy

The controller responsible for data processing on this website is:

Malik Jamshed Iqbal
Lilienweg 26
74252 Massenbachhausen, Germany
Email: info@whattodoin.eu

Given the small scale of this operation, no data protection officer is appointed or legally required under Art. 37 GDPR. For any privacy question or request, please contact us at the email above.

This website's frontend is hosted on Vercel (Vercel Inc., USA), its backend API on Render (Render Services Inc., USA), and its database on MongoDB Atlas (MongoDB, Inc., USA). Each of these providers processes data on our behalf and, where personal data is transferred outside the European Economic Area, does so on the basis of the European Commission's Standard Contractual Clauses and/or its own certification under the EU-U.S. Data Privacy Framework, where applicable.

Each time you access this website, our hosting providers automatically collect technical information transmitted by your browser in server log files: browser type and version, operating system, referrer URL, IP address, and the date and time of the request. This data is processed to ensure technical security and stable operation of the website (Art. 6(1)(f) GDPR — our legitimate interest in providing a functioning, secure service) and is not merged with other data sources. Log files are typically retained for a short period for security and troubleshooting purposes before being automatically deleted or anonymized.

If you contact us via the contact form, we store the information you provide (name, email address, subject, and message) in our database in order to process and respond to your inquiry. The legal basis is Art. 6(1)(b) GDPR (steps taken at your request prior to entering into, or in connection with, a possible agreement) and, where not directly covered by that, our legitimate interest in responding to inquiries addressed to us (Art. 6(1)(f) GDPR). We do not share this data with third parties without your consent. We retain contact form submissions for as long as necessary to handle your inquiry and any related follow-up, and delete them within 12 months of our last correspondence unless a longer retention period is required by law.

If you subscribe to our newsletter, we store your email address in order to send you travel content and updates. The legal basis is your consent (Art. 6(1)(a) GDPR), given by submitting the newsletter form. We retain your email address for as long as you remain subscribed. You can unsubscribe at any time by contacting us at info@whattodoin.eu; your consent is then considered withdrawn and your email address is deleted from our subscriber list without undue delay.

This website uses PostHog, a web analytics service, to understand how visitors use the site (e.g. pages viewed, general navigation patterns, and, where enabled, session recordings). PostHog is configured to process data on servers located in the United States (US region), on the same legal basis for international transfer described in Section 2.

Analytics cookies and session recording are not active by default. They are only loaded after you actively consent via the cookie banner shown on your first visit, in accordance with §25 TTDSG and Art. 6(1)(a) GDPR. You can withdraw your consent at any time by clearing your browser's local storage for this site or via the link in our Cookie Policy, which lists every cookie/tracker in detail. Analytics data is retained for up to 12 months before being automatically deleted.

You have the right, at any time and generally free of charge, to:

• request access to the personal data we hold about you (Art. 15 GDPR);
• request rectification of inaccurate data (Art. 16 GDPR);
• request erasure of your data (Art. 17 GDPR);
• request restriction of processing (Art. 18 GDPR);
• receive your data in a portable format (Art. 20 GDPR);
• object to processing based on our legitimate interest (Art. 21 GDPR); and
• withdraw any consent you have given, at any time and with future effect (Art. 7(3) GDPR).

To exercise any of these rights, contact us at info@whattodoin.eu.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for our location is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI Baden-Württemberg)
Königstraße 10a, 70173 Stuttgart, Germany
www.baden-wuerttemberg.datenschutz.de

Beyond the specific retention periods noted above, we store personal data only for as long as necessary for the purpose it was collected for, or as required by applicable statutory retention obligations. Data is deleted or anonymized once these purposes no longer apply.

This website is not directed at children, and we do not knowingly collect personal data from individuals under the age of 16. If you believe a child has provided us with personal data, please contact us so we can delete it.

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. The version published on this page is always the current one.