Privacy Policy
Last updated: 18 August 2026
1. Controller
The controller responsible for the processing of personal data on the websites bavaroona.com and booking.bavaroona.com is:
Bavaroona Tours UG (haftungsbeschränkt)
Kriemhildenstraße 36
80639 Munich
Germany
Email: hello@bavaroona.com
Managing Director: Bernd Roeren
This Privacy Policy explains how we collect, use and protect personal data when you visit our websites, make a booking, contact us or otherwise use our services.
2. General Information on Data Processing
We process personal data only where this is necessary to provide our websites and services, perform contracts, comply with legal obligations, protect legitimate interests or where you have given us your consent.
Depending on the specific processing activity, the legal basis may in particular be:
Article 6(1)(a) GDPR – consent;
Article 6(1)(b) GDPR – performance of a contract or pre-contractual measures;
Article 6(1)(c) GDPR – compliance with a legal obligation;
Article 6(1)(f) GDPR – our legitimate interests or the legitimate interests of a third party.
Where information is stored on or accessed from your device, we also comply with the requirements of Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG).
3. Hosting and Technical Website Operation
Our booking platform and parts of our technical infrastructure are operated using Lovable Cloud and Supabase.
In connection with the provision and operation of the websites, technical information may be processed, including:
IP address;
date and time of access;
requested page or resource;
browser and device information;
operating system;
request and response information;
technical identifiers;
authentication and session information.
This processing is necessary to deliver the websites securely, maintain their functionality, detect technical errors and prevent misuse.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are the secure, reliable and efficient operation of our websites.
Where the infrastructure is required to provide services requested by you, Article 6(1)(b) GDPR may additionally apply.
4. Bookings and Customer Data
When you book a Bavaroona experience, we process the information necessary to handle and fulfil your booking.
This may include:
first and last name;
email address;
telephone number, where provided;
names and contact information of participants;
selected tour;
selected date and time;
number of participants;
booking price;
discount or promotional codes;
booking ID;
booking status;
payment status;
communication relating to the booking.
The data is used to:
process and manage your booking;
provide the booked tour;
contact you regarding your booking;
provide relevant tour information;
manage cancellations or changes;
process payments and refunds;
provide customer support.
The legal basis is Article 6(1)(b) GDPR.
Where information must be retained for accounting, tax or other statutory purposes, processing is additionally based on Article 6(1)(c) GDPR.
5. Lovable Cloud and Supabase
We use infrastructure provided through Lovable Cloud and Supabase for functions including:
database hosting;
booking management;
storage of customer and booking data;
authentication;
administrative access;
session management;
server-side application functionality.
Depending on the relevant function, the following information may be processed:
customer names;
email addresses;
telephone numbers;
participant information;
booking details;
prices and discount codes;
payment status;
user IDs;
authentication information;
session tokens;
administrative roles.
These providers process data on our behalf to the extent that they act as processors.
The legal basis for our processing is primarily Article 6(1)(b) GDPR for booking-related information and Article 6(1)(f) GDPR for secure technical operation.
6. Payment Processing with Stripe
We use Stripe to process payments.
For customers in the European Economic Area, payment services may in particular be provided by:
Stripe Payments Europe, Limited
1 Grand Canal Street Lower
Grand Canal Dock
Dublin D02 H210
Ireland
When you make a payment, data may be transmitted to and processed by Stripe, including:
name;
email address;
payment amount;
currency;
booking or transaction ID;
payment method information;
payment status;
transaction date;
information about the purchased service;
information necessary for payment authentication and fraud prevention.
Payment card information is processed directly through Stripe's payment infrastructure. Bavaroona does not need to store your complete payment card details in its own database.
Payment processing is necessary to fulfil the booking contract. The legal basis is Article 6(1)(b) GDPR.
Additional processing may be necessary for fraud prevention, payment security and compliance with legal obligations.
Stripe may process certain information as an independent controller in accordance with its own privacy policy.
7. Transactional Emails
We use email infrastructure provided through Lovable to send transactional emails from our Bavaroona email infrastructure.
This may include:
booking confirmations;
booking changes;
cancellation confirmations;
important information about your tour;
payment-related notifications;
operational customer communication.
For this purpose, we may process:
your name;
email address;
booking information;
tour information;
cancellation information;
content of the relevant message.
The legal basis for emails necessary to administer your booking is Article 6(1)(b) GDPR.
Where we send review requests or other follow-up communication that is not strictly necessary for performance of the contract, we do so only where permitted by applicable law. Where consent is required, the legal basis is Article 6(1)(a) GDPR.
8. Authentication and Administrative Accounts
Our platform uses authentication functionality provided through Lovable Cloud and Supabase.
Where account or administrative login functionality is used, information such as the following may be processed:
email address;
user ID;
authentication token;
session information;
account role;
OAuth provider information.
Where social login functionality is used, authentication may involve providers such as Google, Apple, Microsoft or Lovable.
The respective authentication provider may process information in accordance with its own privacy policy.
The legal basis for the processing by Bavaroona is Article 6(1)(b) GDPR where authentication is required to provide a requested service, or Article 6(1)(f) GDPR where authentication is necessary to protect administrative systems and customer information.
9. Cookies and Similar Technologies
Our websites use cookies and similar technologies.
We distinguish between the following categories:
Necessary Technologies
Necessary technologies are required for the technical operation, security, booking process, authentication, session management or payment functionality of the website.
Where access to or storage of information on your device is strictly necessary to provide a digital service requested by you, consent is not required under Section 25(2) TDDDG.
Where personal data is processed, the relevant legal basis may be Article 6(1)(b) or Article 6(1)(f) GDPR.
Analytics Technologies
Analytics technologies help us understand how visitors use our websites and how we can improve our services.
These technologies are only activated where the required consent has been given.
Marketing Technologies
Marketing technologies may be used to measure advertising performance, attribute bookings to advertising campaigns and optimise our advertising.
These technologies are only activated where the required consent has been given.
You can withdraw or modify your consent at any time through the Cookie Settings available on our website.
Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
10. Google Analytics 4
We use Google Analytics 4, a web analytics service provided by Google.
For users in the European Economic Area, the relevant Google entity is generally:
Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland
Google Analytics allows us to understand how visitors use our websites and booking platform.
Depending on your consent and configuration, the following information may be processed:
pages and URLs visited;
interactions with the website;
device and browser information;
approximate location information;
IP address;
referrer information;
session information;
technical identifiers;
tour viewed;
booking value;
currency;
transaction ID;
tour name;
ecommerce and conversion events.
We do not intentionally transmit complete payment card information to Google Analytics.
Google Analytics is used only where you have provided the required consent.
The legal basis is Article 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG where information is stored on or accessed from your device.
You can withdraw your consent at any time through the Cookie Settings.
11. Google Ads and Conversion Measurement
We may use Google Ads conversion tracking in connection with our advertising campaigns.
This allows us to measure whether a person who interacted with a Bavaroona advertisement subsequently performs an action such as viewing a tour, beginning the booking process or completing a booking.
Where Google Ads conversion tracking is active and you have given your consent, information processed may include:
advertising interaction information;
Google Click Identifier (GCLID) or comparable identifiers;
browser and device information;
IP address;
conversion event;
transaction ID;
booking value;
currency;
information about the booked tour.
This information enables us to measure the effectiveness of advertising campaigns and optimise our advertising expenditure.
The legal basis is Article 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG where device storage or access is involved.
Google Ads marketing and conversion technologies requiring consent are not activated unless the necessary consent has been provided.
You can withdraw your consent at any time through the Cookie Settings.
12. Google Consent Mode
We use Google Consent Mode to communicate your consent choices to Google services used on our websites.
Depending on your selection, consent signals may include:
analytics_storage;
ad_storage;
ad_user_data;
ad_personalization.
These signals are used to control whether and how Google Analytics and Google Ads technologies may process analytics or advertising-related information.
Your consent choices can be changed at any time through the Cookie Settings.
13. Google Fonts
Our website currently uses fonts loaded from infrastructure provided by Google.
When such font files are retrieved from Google's servers, technical information may be transmitted to Google, including:
IP address;
browser information;
device information;
request headers;
date and time of the request.
The fonts are used to ensure consistent visual presentation of our websites.
Where the loading of external fonts involves access to information on your device or processing requiring consent, the relevant technologies are only used subject to the applicable consent requirements.
We are working to minimise unnecessary transmission of visitor information to external providers.
14. Google Cloud Storage and Social Preview Images
Certain images or social-media preview assets may be hosted through infrastructure provided by Google Cloud Storage.
When these resources are requested, Google may receive technical information such as:
IP address;
browser or crawler information;
request headers;
date and time of access;
requested file.
This processing serves the reliable delivery of website and social preview assets.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the reliable and technically efficient presentation of our online content.
15. Reviews and Review Widget
We may display customer reviews on our websites.
The review functionality may process or display information such as:
reviewer name;
star rating;
review text;
tour reviewed.
Where a review is published, only information intended for publication is displayed.
Our booking platform also provides a review widget that can be embedded on bavaroona.com. When the widget is loaded, technical information such as the visitor's IP address may be transmitted between bavaroona.com and booking.bavaroona.com.
Both websites are operated by Bavaroona Tours UG (haftungsbeschränkt).
The legal basis for the technical provision of the widget is Article 6(1)(f) GDPR. Our legitimate interest is presenting genuine customer experiences and information about our tours.
Where customer consent is required for publication of review information, the legal basis is Article 6(1)(a) GDPR.
16. Contacting Us
If you contact us by email, through a contact form or through another communication channel, we process the information you provide.
This may include:
name;
email address;
telephone number;
content of the message;
booking information;
other information voluntarily provided by you.
If your request relates to a booking or potential booking, the legal basis is Article 6(1)(b) GDPR.
For general enquiries, the legal basis is Article 6(1)(f) GDPR. Our legitimate interest is responding to enquiries directed to our company.
17. Security and Fraud Prevention
We process technical and transaction-related information where necessary to:
protect customer accounts and booking data;
prevent unauthorised access;
detect fraudulent transactions;
investigate misuse;
maintain website and payment security;
diagnose technical problems.
Depending on the circumstances, the legal basis is Article 6(1)(f) GDPR or Article 6(1)(c) GDPR.
Our legitimate interest is maintaining the security and integrity of our websites, booking system, customers and business.
18. International Data Transfers
Some of the service providers used by us operate globally.
As a result, personal data may in certain cases be processed outside the European Economic Area.
Where personal data is transferred to a country outside the European Economic Area, we ensure that an appropriate transfer mechanism is used where required by law.
Depending on the provider and destination, this may include:
an adequacy decision by the European Commission;
participation in an applicable recognised data privacy framework;
Standard Contractual Clauses approved by the European Commission;
other safeguards permitted under Chapter V GDPR.
19. Data Retention
We retain personal data only for as long as necessary for the purposes for which it was collected.
Booking and customer information may be retained for the duration necessary to:
fulfil the contract;
handle customer enquiries;
process cancellations, disputes or refunds;
establish, exercise or defend legal claims;
comply with statutory accounting, tax and commercial retention obligations.
Where processing is based on consent, information is generally processed until consent is withdrawn or until the purpose no longer applies, subject to any applicable legal retention requirements.
Technical data is deleted or anonymised when it is no longer required for security, operational or analytical purposes.
20. Recipients of Personal Data
Depending on the service used, personal data may be disclosed to or processed by:
hosting and cloud infrastructure providers;
database providers;
payment processors;
email service providers;
authentication providers;
analytics providers;
advertising and conversion measurement providers;
IT and technical service providers;
public authorities where disclosure is required by law.
We only disclose personal data where this is necessary for the relevant purpose and legally permitted.
21. Your Rights
Subject to the conditions of applicable data protection law, you have the right to:
request access to your personal data;
request correction of inaccurate personal data;
request deletion of your personal data;
request restriction of processing;
receive personal data you have provided to us in a structured, commonly used and machine-readable format where the requirements for data portability are met;
object to processing based on legitimate interests;
withdraw consent at any time with effect for the future.
If processing is based on Article 6(1)(f) GDPR, you have the right to object to processing on grounds relating to your particular situation.
Where personal data is processed for direct marketing purposes, you have the right to object to such processing at any time.
To exercise your rights, contact:
22. Right to Lodge a Complaint
You have the right to lodge a complaint with a competent data protection supervisory authority if you believe that the processing of your personal data infringes applicable data protection law.
The supervisory authority responsible for private-sector companies based in Bavaria is:
Bavarian State Office for Data Protection Supervision
(Bayerisches Landesamt für Datenschutzaufsicht – BayLDA)
Promenade 18
91522 Ansbach
Germany
You may also contact another supervisory authority competent under applicable data protection law.
23. Withdrawal of Consent
Where processing is based on your consent, you may withdraw that consent at any time with effect for the future.
For cookies, Google Analytics and advertising technologies, you can change your decision through the Cookie Settings provided on our websites.
The withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
24. Changes to This Privacy Policy
We may update this Privacy Policy where our services, technical infrastructure, legal requirements or data processing activities change.
The current version is always available on our website.
Last updated: 18 August 2026
