Legal
Privacy Policy
We collect only what we need, keep it only as long as required, and never sell it. This policy explains exactly what we do with your data.
1. Who we are
TripPlay GmbH ("TripPlay", "we", "us") is a travel company registered in Germany (HRB 12345 B, Amtsgericht Berlin-Charlottenburg) with offices in Beijing and Berlin. We operate the TripPlay website and related booking services.
Data controller: TripPlay GmbH, Torstraße 142, 10119 Berlin, Germany. Data protection officer: [email protected]
2. What personal data we collect
We collect the following categories of personal data:
When you enquire or book:
When you visit our website:
When you interact with us:
3. Why we use your data
We process your personal data for the following purposes and legal bases:
To fulfil your booking (contractual necessity):
We need your name, passport details, and contact information to confirm reservations, issue tour documents, coordinate with hotels and transport providers, and communicate with you about your trip.
To process payments (contractual necessity):
We pass payment details to Stripe, our PCI-DSS-compliant payment processor. Stripe's privacy policy applies to payment processing.
To comply with legal obligations:
We retain financial records for 10 years as required by German commercial law. We may share data with authorities when legally required.
With your consent:
We send marketing emails and newsletters only to subscribers who have explicitly opted in. You can unsubscribe at any time.
For legitimate interests:
We use anonymised analytics to improve our website and services. We do not use this data to identify individuals.
5. International transfers
Because we operate tours in China, some of your data (specifically your name and contact number) is shared with our Beijing office and local suppliers. China is not currently recognised by the EU as providing adequate data protection.
We protect these transfers through:
Your payment data never leaves the EU.
6. How long we keep your data
We retain different categories of data for different periods:
After these periods, we permanently delete or irreversibly anonymise your data.
7. Your rights under GDPR
As an EU/EEA resident (and under UK GDPR for UK residents), you have the following rights:
To exercise any right, email [email protected]. We will respond within 30 days. We may ask you to verify your identity before fulfilling a request.
If you are unsatisfied with our response, you have the right to lodge a complaint with the Berliner Beauftragte für Datenschutz und Informationsfreiheit (the Berlin data protection authority) or your local supervisory authority.
9. Security
We take reasonable technical and organisational measures to protect your data:
In the event of a data breach that is likely to affect your rights, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of it.
10. Changes to this policy
We may update this policy from time to time. We will notify active customers of material changes by email at least 30 days before they take effect. The "last updated" date at the top of this page will always reflect the current version.
For questions about this policy, contact us at [email protected] or by post at: TripPlay GmbH, Torstraße 142, 10119 Berlin, Germany.