← holidayhub

Privacy policy

1. Controller

The controller for the data processing on this website is:
Seloralabs (in formation), email hello@seloralabs.com. Further details in the legal notice.

2. Hosting

The website is hosted with Render (Render Services, Inc.) in the Frankfurt (EU) data centre. When the site is accessed, the server processes technically necessary access data (including IP address, timestamp, requested resource, referrer, user agent) to deliver and secure the service. The legal basis is the legitimate interest in secure, functional operation (Art. 6 (1) lit. f GDPR).

3. Database & authentication (Supabase)

For data storage and – in future – authentication we use Supabase (West-EU region). Personal data is only processed insofar as you use the corresponding functions. In phase 0, public sign-ups are disabled. Legal basis: performance of a contract or legitimate interest (Art. 6 (1) lit. b, f GDPR).

4. Cookies & consent

We use technically necessary storage without consent. We only set cookies and comparable technologies for analytics purposes after you have expressly agreed in the cookie banner (opt-in). You can change or withdraw your choice at any time via “Cookie settings” in the footer. Legal basis: your consent (Art. 6 (1) lit. a GDPR, § 25 (1) TDDDG).

5. Web analytics (PostHog, Google Analytics)

To analyse usage we use PostHog (EU cloud) – but exclusively after your consent. Without consent no analytics cookies are set and no analytics data is collected. After consent we process usage and device information (including pages visited, interactions, truncated location/device details) to improve the product. Personal profiles are only created upon explicit identification; session recording is disabled. Legal basis: consent (Art. 6 (1) lit. a GDPR). Provider: PostHog, data processing in the EU.

Also only after your consent to the “Analytics” category we use Google Analytics 4 (gtag.js) – for reach/traffic measurement and to attribute advertising campaigns. Without consent the Google script is not loaded and no such cookies are set. After consent the provider Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) processes usage and device information (including pages visited, truncated IP address, approximate location, device/browser details); this may involve a transfer to the USA to Google LLC, safeguarded by the EU standard contractual clauses or the EU-US Data Privacy Framework. You can withdraw your consent at any time with effect for the future via “Cookie settings” in the footer. Legal basis: your consent (Art. 6 (1) lit. a GDPR, § 25 (1) TDDDG).

“Google signals” are enabled in the property. Google uses your usage behaviour to build audiences for later advertising campaigns and calls a tracking pixel at the Google country domain of your location (for example www.google.de). This goes beyond plain reach measurement and only happens after your consent to the “Analytics” category.

6. Error monitoring (Sentry)

For stability we collect technical error reports via Sentry. Technical data (including error message, browser, truncated IP) may be processed; personal data is not deliberately collected (sendDefaultPii disabled). Legal basis: legitimate interest in error-free operation (Art. 6 (1) lit. f GDPR).

7. Affiliate/commission links & marketing tracking (Travelpayouts)

Some links on HolidayHub are affiliate/commission links: if you book via such a link, we may receive a commission from the provider. The price does not change for you. These links help keep HolidayHub free.

When you click on such a link, the respective partner may set cookies and process data for which the partner is responsible. Please refer to the privacy notices of the respective provider for details.

To broker and settle these partner programmes we use – but exclusively after your consent to the “Marketing” category – a tracking script from Travelpayouts (Travelpayouts Inc.). It is loaded via the provider host tp-em.com and attributes clicks on partner links to the referral by HolidayHub (affiliate attribution). The provider may set cookies and process usage/device information in the process. Without your consent this script is not loaded and no such cookies are set. You can withdraw your consent at any time with effect for the future via “Cookie settings” in the footer; the script will then no longer be loaded. Legal basis: your consent (Art. 6 (1) lit. a GDPR, § 25 (1) TDDDG).

The Travelpayouts script loads a further component of the provider. This reports errors and load times to a service operated by Aviasales (sentry.avs.io) – transmitted are the error message, the page visited, browser and device details, and your IP address. Your session is not recorded. The same component also checks whether an ad blocker is active in your browser; to do so it calls three addresses of Google advertising networks (pagead2.googlesyndication.com, securepubads.g.doubleclick.net, static.doubleclick.net). No cookies are set and no advertising is delivered in the process; the named providers do, however, receive your IP address. Both only happen after your consent to the “Marketing” category and end when you withdraw it. Legal basis: your consent (Art. 6 (1) lit. a GDPR, § 25 (1) TDDDG).

8. Newsletter / Crowd Report (Brevo)

When you subscribe to our newsletter (monthly “Crowd Report”), we process your email address, selected language, and the time, source, and version of your consent. The source includes the sign-up form’s statement of which travel region page you subscribed from. This attribution is statistical; it is not a subscription to that region and does not trigger any region-specific messages. The subscription uses double opt-in: after signing up you receive a confirmation email, and your address is only activated for delivery after your express confirmation. The confirmation link expires after 24 hours. Unconfirmed sign-ups are deleted afterwards, triggered by the next sign-up through our form. Deletion may therefore be delayed.

For delivery and contact management we use Brevo (Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France). Your email address, language, delivery information, and unsubscribe status are processed within the European Union; the basis is a data processing agreement under Art. 28 GDPR. We do not use your newsletter data for open/click profiling. Unsubscribed addresses remain in a minimal suppression list so that no further messages are sent and consent/withdrawal remain verifiable. You can withdraw your consent at any time with effect for the future via the unsubscribe link in every edition. Legal basis: your consent (Art. 6 (1) lit. a GDPR).

9. Map display (OpenFreeMap / OpenStreetMap)

On the “Map” page and in the map section of the home page we embed an interactive vector map. The map tiles and map style are delivered directly to your browser from the servers of the provider OpenFreeMap (tiles.openfreemap.org). For technical reasons your IP address is transmitted to OpenFreeMap in the process; further access data (including requested tiles, timestamp, user agent, referrer) may also be processed. The underlying map data comes from the OpenStreetMap project (© OpenStreetMap contributors). OpenFreeMap is an open-source, free map service; no user account is required and we do not set any tracking cookies through it. The map is only loaded once you open the map page or scroll down to the map section on the home page. The legal basis is our legitimate interest in a performant, map-based presentation of the travel information (Art. 6 (1) lit. f GDPR).

10. Cover photos and cover videos (Unsplash, Pexels)

The home page and the travel-region pages show a cover photo in the header, the travel-region pages and the map page also show illustrated offer tiles; for selected regions a short muted cover video is added. The photos are delivered directly to your browser from the servers of the provider Unsplash (images.unsplash.com), the videos directly from the servers of the provider Pexels (videos.pexels.com). For technical reasons your IP address is transmitted to the respective provider in the process; further access data (requested file, timestamp, user agent, referrer) may also be processed. We do not set any cookies through this and transmit no further data. Photo and video are part of the page itself and therefore technically necessary; they are loaded when the page opens, regardless of your choice in the cookie banner, and no consent is required for this. If your browser reports reduced motion or a data-saver mode, only the photo is shown. Both providers may use servers outside the EU; details are in the privacy notices of Unsplash and Pexels. The legal basis is our legitimate interest in a vivid presentation of the travel information (Art. 6 (1) lit. f GDPR).

11. Your rights

You have the following rights with respect to your personal data:

  • Access (Art. 15 GDPR)
  • Rectification (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection (Art. 21 GDPR)
  • Withdrawal of consent given, with effect for the future

You also have the right to lodge a complaint with a data protection supervisory authority.

12. Notice for users in Switzerland (CH-DSG)

For users from Switzerland, the requirements of the revised Swiss Data Protection Act (revDSG) apply in addition. The processing operations, purposes and data-subject rights described above apply accordingly; the competent supervisory authority is the Federal Data Protection and Information Commissioner (FDPIC).

13. Status & changes

We update this privacy policy as soon as the data processing changes.