← holidayhub

Privacy policy

1. Controller

The controller for the data processing on this website is:
Seloralabs (in formation), email hello@seloralabs.com. Further details in the legal notice.

2. Hosting

The website is hosted with Render (Render Services, Inc.) in the Frankfurt (EU) data centre. When the site is accessed, the server processes technically necessary access data (including IP address, timestamp, requested resource, referrer, user agent) to deliver and secure the service. The legal basis is the legitimate interest in secure, functional operation (Art. 6 (1) lit. f GDPR).

3. Database & authentication (Supabase)

For data storage and – in future – authentication we use Supabase (West-EU region). Personal data is only processed insofar as you use the corresponding functions. In phase 0, public sign-ups are disabled. Legal basis: performance of a contract or legitimate interest (Art. 6 (1) lit. b, f GDPR).

4. Cookies & consent

We use technically necessary storage without consent. We only set cookies and comparable technologies for analytics purposes after you have expressly agreed in the cookie banner (opt-in). You can change or withdraw your choice at any time via “Cookie settings” in the footer. Legal basis: your consent (Art. 6 (1) lit. a GDPR, § 25 (1) TDDDG).

5. Web analytics (PostHog, Google Analytics)

To analyse usage we use PostHog (EU cloud) – but exclusively after your consent. Without consent no analytics cookies are set and no analytics data is collected. After consent we process usage and device information (including pages visited, interactions, truncated location/device details) to improve the product. Personal profiles are only created upon explicit identification; session recording is disabled. Legal basis: consent (Art. 6 (1) lit. a GDPR). Provider: PostHog, data processing in the EU.

Also only after your consent to the “Analytics” category we use Google Analytics 4 (gtag.js) – for reach/traffic measurement and to attribute advertising campaigns. Without consent the Google script is not loaded and no such cookies are set. After consent the provider Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) processes usage and device information (including pages visited, truncated IP address, approximate location, device/browser details); this may involve a transfer to the USA to Google LLC, safeguarded by the EU standard contractual clauses or the EU-US Data Privacy Framework. You can withdraw your consent at any time with effect for the future via “Cookie settings” in the footer. Legal basis: your consent (Art. 6 (1) lit. a GDPR, § 25 (1) TDDDG).

6. Error monitoring (Sentry)

For stability we collect technical error reports via Sentry. Technical data (including error message, browser, truncated IP) may be processed; personal data is not deliberately collected (sendDefaultPii disabled). Legal basis: legitimate interest in error-free operation (Art. 6 (1) lit. f GDPR).

7. Affiliate/commission links & marketing tracking (Travelpayouts)

Some links on HolidayHub are affiliate/commission links: if you book via such a link, we may receive a commission from the provider. The price does not change for you. These links help keep HolidayHub free.

When you click on such a link, the respective partner may set cookies and process data for which the partner is responsible. Please refer to the privacy notices of the respective provider for details.

To broker and settle these partner programmes we use – but exclusively after your consent to the “Marketing” category – a tracking script from Travelpayouts (Travelpayouts Inc.). It is loaded via the provider host tp-em.com and attributes clicks on partner links to the referral by HolidayHub (affiliate attribution). The provider may set cookies and process usage/device information in the process. Without your consent this script is not loaded and no such cookies are set. You can withdraw your consent at any time with effect for the future via “Cookie settings” in the footer; the script will then no longer be loaded. Legal basis: your consent (Art. 6 (1) lit. a GDPR, § 25 (1) TDDDG).

8. Newsletter / Crowd Report (Brevo)

When you subscribe to our newsletter (monthly “Crowd Report”), we process your email address, selected language, and the time, source, and version of your consent. The source includes the sign-up form’s statement of which travel region page you subscribed from. This attribution is statistical; it is not a subscription to that region and does not trigger any region-specific messages. The subscription uses double opt-in: after signing up you receive a confirmation email, and your address is only activated for delivery after your express confirmation. Unconfirmed subscriptions expire after 24 hours.

For delivery and contact management we use Brevo (Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France). Your email address, language, delivery information, and unsubscribe status are processed within the European Union; the basis is a data processing agreement under Art. 28 GDPR. We do not use your newsletter data for open/click profiling. Unsubscribed addresses remain in a minimal suppression list so that no further messages are sent and consent/withdrawal remain verifiable. You can withdraw your consent at any time with effect for the future via the unsubscribe link in every edition. Legal basis: your consent (Art. 6 (1) lit. a GDPR).

9. Map display (OpenFreeMap / OpenStreetMap)

On the “Map” page we embed an interactive vector map. The map tiles and map style are delivered directly to your browser from the servers of the provider OpenFreeMap (tiles.openfreemap.org). For technical reasons your IP address is transmitted to OpenFreeMap in the process; further access data (including requested tiles, timestamp, user agent, referrer) may also be processed. The underlying map data comes from the OpenStreetMap project (© OpenStreetMap contributors). OpenFreeMap is an open-source, free map service; no user account is required and we do not set any tracking cookies through it. The map is only loaded when you open the map page. The legal basis is our legitimate interest in a performant, map-based presentation of the travel information (Art. 6 (1) lit. f GDPR).

10. Your rights

You have the following rights with respect to your personal data:

  • Access (Art. 15 GDPR)
  • Rectification (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection (Art. 21 GDPR)
  • Withdrawal of consent given, with effect for the future

You also have the right to lodge a complaint with a data protection supervisory authority.

11. Notice for users in Switzerland (CH-DSG)

For users from Switzerland, the requirements of the revised Swiss Data Protection Act (revDSG) apply in addition. The processing operations, purposes and data-subject rights described above apply accordingly; the competent supervisory authority is the Federal Data Protection and Information Commissioner (FDPIC).

12. Status & changes

We update this privacy policy as soon as the data processing changes.