法律

隐私政策

我们只收集必要的信息，只在必要的期限内保留，且绝不出售。本政策清楚说明我们如何处理你的数据。（以下条文正文以英文版为准。）

最后更新：2026年1月1日·适用于所有 TripPlay 预订服务

1. 我们是谁

TripPlay GmbH ("TripPlay", "we", "us") is a travel company registered in Germany (HRB 12345 B, Amtsgericht Berlin-Charlottenburg) with offices in Beijing and Berlin. We operate the TripPlay website and related booking services.

Data controller: TripPlay GmbH, Torstraße 142, 10119 Berlin, Germany. Data protection officer: [email protected]

2. 我们收集哪些个人数据

We collect the following categories of personal data:

When you enquire or book:

•Name, email address, phone number, postal address

•Passport details and nationality (required for tour documentation)

•Travel preferences, dietary requirements, and health information you choose to provide

•Payment information (processed by Stripe — we do not store card numbers)

When you visit our website:

•IP address, browser type, pages visited, time on site

•Device type and operating system

•Referral source (how you found us)

When you interact with us:

•Chat messages and email correspondence

•Reviews and feedback you submit

•Newsletter subscription status

3. 我们为何使用你的数据

We process your personal data for the following purposes and legal bases:

To fulfil your booking (contractual necessity):

We need your name, passport details, and contact information to confirm reservations, issue tour documents, coordinate with hotels and transport providers, and communicate with you about your trip.

To process payments (contractual necessity):

We pass payment details to Stripe, our PCI-DSS-compliant payment processor. Stripe's privacy policy applies to payment processing.

To comply with legal obligations:

We retain financial records for 10 years as required by German commercial law. We may share data with authorities when legally required.

With your consent:

We send marketing emails and newsletters only to subscribers who have explicitly opted in. You can unsubscribe at any time.

For legitimate interests:

We use anonymised analytics to improve our website and services. We do not use this data to identify individuals.

5. 跨境传输

Because we operate tours in China, some of your data (specifically your name and contact number) is shared with our Beijing office and local suppliers. China is not currently recognised by the EU as providing adequate data protection.

We protect these transfers through:

•Standard contractual clauses approved by the European Commission

•Internal data handling policies binding on our Beijing staff

•Limiting transfer to the minimum data necessary (name and phone number only)

Your payment data never leaves the EU.

6. 我们保留数据多久

We retain different categories of data for different periods:

•Booking and trip records: 6 years after the trip date (for warranty and dispute resolution)

•Financial records: 10 years (German commercial law)

•Newsletter subscription data: Until you unsubscribe, then deleted within 30 days

•Website analytics: 14 months (Google Analytics default, anonymised)

•Chat records: 12 months

•Enquiries that did not lead to a booking: 24 months

After these periods, we permanently delete or irreversibly anonymise your data.

7. 你在 GDPR 下的权利

As an EU/EEA resident (and under UK GDPR for UK residents), you have the following rights:

•Right of access: Request a copy of all personal data we hold about you

•Right to rectification: Ask us to correct inaccurate data

•Right to erasure ("right to be forgotten"): Ask us to delete your data, subject to our legal retention obligations

•Right to restriction: Ask us to pause processing while a dispute is resolved

•Right to portability: Receive your data in a machine-readable format

•Right to object: Object to processing based on legitimate interests or for direct marketing

•Right to withdraw consent: Withdraw consent for marketing at any time, without affecting processing already carried out

To exercise any right, email [email protected]. We will respond within 30 days. We may ask you to verify your identity before fulfilling a request.

If you are unsatisfied with our response, you have the right to lodge a complaint with the Berliner Beauftragte für Datenschutz und Informationsfreiheit (the Berlin data protection authority) or your local supervisory authority.

8. Cookie

We use the following cookies:

Strictly necessary (no consent required):

•Session cookies for the booking flow

•Security tokens (CSRF protection)

Analytics (consent required):

•Google Analytics (_ga, _gid) — anonymised traffic analysis

•Hotjar — anonymised user behaviour (no PII captured)

Marketing (consent required):

•Meta Pixel — only if you clicked a Facebook/Instagram ad to reach us

•Google Ads conversion tracking

You can manage cookie preferences via the "Cookie settings" link in the footer. Withdrawing consent does not affect functionality.

9. 安全

We take reasonable technical and organisational measures to protect your data:

•All data transmitted via TLS 1.3 encryption

•Payment data handled exclusively by Stripe (PCI-DSS Level 1)

•Internal access to personal data restricted on a need-to-know basis

•Staff trained annually on data protection

•Regular security audits of our booking platform

In the event of a data breach that is likely to affect your rights, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of it.

10. 本政策的变更

We may update this policy from time to time. We will notify active customers of material changes by email at least 30 days before they take effect. The "last updated" date at the top of this page will always reflect the current version.

For questions about this policy, contact us at [email protected] or by post at: TripPlay GmbH, Torstraße 142, 10119 Berlin, Germany.

联系我们 [email protected]