Privacy Policy

1. Controller

The controller responsible for the processing of personal data through MyTripoga within the meaning of the General Data Protection Regulation (“GDPR”) is:

2. General Information and Legal Bases

Personal data is any information relating to an identified or identifiable natural person. Depending on how you use MyTripoga, this may include technical access information, communication data, consent preferences, pseudonymous website analytics information, and information generated when you interact with consented third-party or travel partner tools.

We process personal data only where a legal basis exists and only for the purposes described in this Privacy Policy.

Legal bases under the GDPR

Depending on the particular processing activity, processing may be based on:

• Article 6(1)(a) GDPR — Consent: where you voluntarily consent to website statistics, newsletter marketing, optional email tracking, non-essential cookies, embedded third-party tools, or other optional processing.
• Article 6(1)(b) GDPR — Contract or pre-contractual measures: where processing is necessary to respond to a request connected with a contract or potential contractual relationship.
• Article 6(1)(c) GDPR — Legal obligation: where processing is necessary to comply with legal obligations, including documentation, accounting, or consent-management requirements.
• Article 6(1)(f) GDPR — Legitimate interests: where processing is necessary for our legitimate interests, particularly the secure, reliable, efficient and economically sustainable operation of MyTripoga, provided that these interests are not overridden by your rights and freedoms.

Cookies and access to your device

Where information is stored on or accessed from your device, Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG) also applies. Non-essential storage or access is used only after the required consent has been obtained. Storage or access that is strictly necessary to provide a service expressly requested by you may be used without such consent where the legal requirements for the exemption are met.

3. Hosting, Domain and Email Services

MyTripoga uses Hostinger for web hosting, domain-related services, website infrastructure, backups and business email services.

When you access MyTripoga, personal data required to deliver the website may be processed on Hostinger infrastructure. This can include IP addresses, technical request and connection data, server log information, communication data, website data and other information generated through use of the website.

Hostinger also provides the mailbox used for info@mytripoga.com. Messages sent to this address may therefore be processed and stored within Hostinger's email infrastructure.

The legal basis for technically necessary hosting and infrastructure processing is Article 6(1)(f) GDPR. Our legitimate interest is the secure, stable and efficient provision of MyTripoga. Where hosting infrastructure is used to process contractual or pre-contractual communications, Article 6(1)(b) GDPR may additionally apply.

We use Hostinger as a processor for relevant customer data and use the data processing arrangements provided by Hostinger. Hostinger may engage approved sub-processors for infrastructure, security, email delivery and related hosting functions.

Further information is available in Hostinger's Privacy Policy.

4. Server Log Files

When you visit MyTripoga, the web server may automatically process technical information required to establish and maintain the connection and to protect the website.

Such information may include:

• IP address
• Date and time of access
• Requested page or file
• Referrer URL, where transmitted by your browser
• Browser type and version
• Operating system and device-related technical information
• HTTP status codes and request information
• Technical error and security information

These data are processed for website delivery, technical troubleshooting, system stability, prevention of abuse and protection against attacks.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are the secure and technically reliable operation of the website, error analysis and protection against misuse.

5. Website Security and Wordfence

We use Wordfence Security to protect MyTripoga against malware, unauthorized access, brute-force login attempts, malicious traffic and other security threats.

Wordfence needs to evaluate technical traffic and security information in order to detect potentially malicious activity. Depending on the request and Wordfence function involved, this may include IP addresses, request information, technical access data, security events and information associated with attempted access to the website.

Wordfence also provides login-security functionality used to protect administrative access to MyTripoga. Two-factor authentication is used for administrative security and is not required from ordinary website visitors.

Processing is based on Article 6(1)(f) GDPR. Our legitimate interest is protecting MyTripoga, our systems and website visitors from unauthorized access, fraud, malicious traffic and cyberattacks.

Defiant is based in the United States. Where personal data is transferred in connection with the Wordfence service, Defiant provides contractual data-protection arrangements including EU Standard Contractual Clauses for relevant transfers.

Further information: Wordfence Privacy Policy.

Encryption

MyTripoga uses SSL/TLS encryption to protect information transmitted between your browser and the website. An encrypted connection can generally be identified by the HTTPS connection shown in your browser.

6. Contact Forms, Email and Telephone

WPForms contact forms

We use WPForms Lite to provide contact forms and other non-newsletter communication forms on MyTripoga.

Depending on the particular form, you may provide information such as:

• Name
• Email address
• Subject
• Message
• Selections or other information entered into optional form fields

WPForms Lite is currently configured without Lite Connect entry backups. Form submissions are therefore not intentionally backed up to the WPForms Lite Connect infrastructure. WPForms Lite also does not provide local form-entry storage in the WordPress dashboard in the configuration used by MyTripoga.

Submitted messages are instead transmitted to our business email environment so that we can respond to the inquiry. Website and email infrastructure used in this process is hosted through Hostinger.

We use WP Mail SMTP as technical routing software for contact-form and other operational website email. The intended outgoing connection for those messages is our Hostinger email infrastructure. Newsletter subscriptions and newsletter delivery are handled separately through Brevo as described below.

Legal basis

If your inquiry concerns a contract or steps prior to entering into a contract, processing is based on Article 6(1)(b) GDPR. For general questions, feedback or other communication, processing is based on Article 6(1)(f) GDPR. Our legitimate interest is responding to legitimate inquiries and communicating with visitors.

Where a particular processing activity expressly asks for your consent, Article 6(1)(a) GDPR applies instead.

Contact by email or telephone

If you contact us directly by email or telephone, we process the information contained in your communication, your contact details and any information necessary to respond to your request.

6.1 Newsletter and Email Marketing with Brevo

You can voluntarily subscribe to the MyTripoga newsletter to receive travel inspiration, destination ideas, planning tips and related editorial updates by email. Newsletter subscriptions and email delivery are managed through Brevo.

Data processed

When you subscribe, we process the information entered in the newsletter form. The email address is required in order to deliver the newsletter. A first name may be provided voluntarily and may be used to manage or personalize the subscription.

Brevo also processes technical and administrative information required to operate and document the subscription process. Depending on the relevant event, this may include the date and time of the sign-up, delivery and transaction information relating to the confirmation email, the date and time of the double opt-in confirmation, subscription status, unsubscribe information, bounce information and other technical logs required to operate the mailing service and document the subscription.

Double opt-in and proof of consent

MyTripoga uses a double opt-in procedure. After submitting the newsletter form, you receive a confirmation email containing a confirmation link. Your subscription is completed only after you click that link. If the confirmation is not completed, the email address is not added to the active MyTripoga newsletter list.

The double opt-in process and the associated logs help us verify that the email address belongs to the person completing the confirmation and allow us to document the consent given for newsletter marketing.

Purpose and legal basis

The purpose of processing is to manage newsletter subscriptions, confirm and document consent, send the MyTripoga newsletter, administer delivery and unsubscribe requests, and maintain the technical reliability of the mailing list.

Newsletter processing and newsletter advertising are based on your consent under Article 6(1)(a) GDPR. Marketing emails are sent only after the required consent has been obtained. The consent is also used to satisfy the requirements applicable to advertising by electronic mail under Section 7 of the German Act Against Unfair Competition (UWG).

Withdrawal and unsubscribe

You may withdraw your newsletter consent at any time for the future, without affecting the lawfulness of processing carried out before the withdrawal. You can unsubscribe using the unsubscribe option included in our newsletter emails or by contacting info@mytripoga.com.

After an unsubscribe or withdrawal, the address will no longer be used for newsletter marketing. Limited information may continue to be retained where necessary to document the withdrawal, maintain a suppression record so that no further newsletter is sent, demonstrate compliance with legal requirements, or establish, exercise or defend legal claims.

Newsletter tracking

Brevo can technically measure whether newsletter emails are opened and whether links contained in a newsletter are clicked. MyTripoga uses Brevo's per-contact tracking-consent setting. Individual open and click tracking is used only where a separate tracking consent has been recorded for the relevant contact. The MyTripoga newsletter form on this website does not currently request a separate tracking consent, so contacts whose tracking consent is unknown are not individually tracked for opens or clicks.

Any separate tracking consent is independent from the consent to receive the newsletter. Where individual open or click tracking is enabled on the basis of such consent, the legal basis is Article 6(1)(a) GDPR and, where information is stored on or accessed from your device, Section 25(1) TDDDG. Any such tracking consent may be withdrawn for the future by contacting info@mytripoga.com without withdrawing the newsletter subscription itself.

Irrespective of individual tracking consent, Brevo may process technical delivery information such as sending status, bounces, complaints, unsubscribes and other operational events where this is necessary to deliver the newsletter, maintain list hygiene, protect the service against abuse and document subscription status.

Brevo as service provider

Brevo processes subscriber information on our behalf for functions such as contact-list management, double opt-in confirmation, email delivery, delivery-status handling, unsubscribe management and related technical logs. Where Brevo acts as our processor, the processing is governed by Brevo's data-processing terms in accordance with Article 28 GDPR.

Brevo states that the hosting servers used to process and store its databases are located within the European Union, including infrastructure in France, Germany and Belgium. Brevo may nevertheless use affiliated companies or sub-processors for support, maintenance or other service functions. Where such processing involves a transfer to a country outside the European Economic Area without an adequacy decision, appropriate safeguards such as the European Commission's Standard Contractual Clauses are used where required.

Further information: Brevo Privacy Policy and Brevo Data Processing Agreement information.

7. Consent Management with Complianz

We use Complianz to manage consent for website statistics, cookies, embedded third-party services and other technologies that may require your permission.

Complianz allows us to obtain, store and manage your consent preferences and to document consent decisions. Because records of consent are enabled on MyTripoga, information associated with a consent decision may include a consent identifier, timestamp, selected preferences, consent status and technical proof required to demonstrate the consent decision.

Complianz may also process an anonymized IP address in connection with records of consent. The purpose of this processing is to remember and implement your privacy choices and, where required, to demonstrate that a consent decision was obtained.

The use of a consent-management platform is based on Article 6(1)(c) GDPR where processing is necessary to comply with legal consent and documentation requirements and Article 6(1)(f) GDPR for the legitimate interest in reliably managing and documenting visitor preferences.

Storage strictly required to remember and implement your consent decision may also be used under the applicable exemption in Section 25(2) TDDDG.

You can withdraw or change consent for future processing at any time using the consent settings provided on the website. Additional information about cookies and individual technologies is available in our Cookie Policy.

Further information: Complianz Privacy Statement.

7.1 Website Analytics with Independent Analytics

We use Independent Analytics to understand how visitors use MyTripoga and to improve our editorial content, website navigation, performance and travel-planning resources. This includes information about page views, visits, pages visited, approximate geographic origin, referring websites and device categories.

How visitor recognition works

According to the developer, Independent Analytics uses a visitor's IP address to determine an approximate geographic location and combines the IP address, browser user-agent information and a site-specific salt to create a one-way hashed visitor identifier. The plugin stores this pseudonymous identifier to distinguish visits and recognize returning visitors.

The IP address is not stored in plain text by the analytics plugin for this purpose. Website analytics data may also include page URLs, referrer information, visit times and device or browser categories.

Independent Analytics does not use analytics cookies. However, a pseudonymous identifier may still be personal data under the GDPR, depending on the circumstances. We therefore explain this processing transparently and use an opt-in configuration through Complianz.

Purpose and legal basis

The purpose of this processing is to measure website usage, identify popular content, understand which destinations and guides visitors find useful, evaluate traffic sources and improve the usability of MyTripoga.

Independent Analytics is integrated with Complianz and configured to record website activity only after you consent to the Statistics category. The legal basis for the associated processing of personal data is Article 6(1)(a) GDPR.

Where access to information on your device is subject to Section 25(1) TDDDG, your consent also covers that access. The applicability of Section 25 depends on the technical operation concerned and is not determined solely by whether cookies are used.

Consent and withdrawal

You can refuse consent to Statistics without losing access to the general editorial content of MyTripoga. You may also withdraw your consent at any time for the future using the cookie and consent settings provided on the website.

Withdrawal does not affect processing carried out lawfully before the withdrawal. Once consent is withdrawn, new analytics tracking should no longer take place under the configured consent mechanism.

Storage and recipients

Analytics records are stored in the MyTripoga WordPress database on our hosting infrastructure. The automatic deletion setting is configured to remove analytics data older than one year.

Website backups may continue to contain older records until they expire under the applicable backup schedule. Hosting and authorized technical service providers may have access where required to operate, maintain or secure the website.

Independent Analytics does not routinely transfer the collected website-statistics database to its developer for reporting. Technical website infrastructure, including hosting and security systems, may process relevant connection information independently of the analytics plugin.

For further technical information, see the Independent Analytics privacy explanation and our Cookie Policy.

7.2 Google Search Console

We use Google Search Console, a service provided by Google, to monitor how MyTripoga appears in Google Search, including search queries, impressions, clicks, indexed pages and technical indexing issues.

We use these reports to improve search visibility, website structure and content quality, and to identify technical problems affecting the discovery or indexing of pages.

Data and processing

Search Console reports are based on information Google collects and processes in connection with its search services. Depending on the report, we may view search queries, impressions, clicks, average search positions, affected URLs and related technical information.

Our use of Search Console does not itself add a Google Analytics tracking script or Search Console visitor-tracking cookies to MyTripoga. We have not enabled Google Analytics 4 as part of this setup.

Property verification and access to Search Console are managed using our Google account and the relevant website verification method.

Legal basis

Where personal data is processed in our administration and evaluation of these reports, our legal basis is Article 6(1)(f) GDPR. Our legitimate interest is maintaining the discoverability of MyTripoga, evaluating search performance and correcting indexing or search-related technical errors.

Google's own processing of search users' information is described in Google's Privacy Policy.

No separate visitor consent on MyTripoga is required merely to access these Search Console reports, provided no additional Google tracking technology is introduced.

8. Cookies and Local Browser Storage

MyTripoga uses cookies and similar browser-storage technologies where they are technically required or where you have given the required consent.

Necessary technologies may be used for functions such as storing consent choices, website security and remembering interface preferences expressly selected by the visitor.

Independent Analytics itself does not set analytics cookies. Its consent-based statistics processing is described in Section 7.1 of this Privacy Policy.

Affiliate-related or embedded third-party technologies that are not strictly necessary are activated only after the required consent has been given.

MyTripoga AI imagery notice preferences

MyTripoga uses limited browser storage to remember your interaction with our AI imagery disclosures.

• mtpAiImageryNoticeAcknowledged: stored in localStorage after you acknowledge the first-visit AI imagery notice, so that the larger notice does not repeatedly appear in the same browser.
• mtpAiNoticeCollapsed: stored in sessionStorage when you collapse the permanent AI imagery notice, so that the preference can be remembered for the current browser session.

These entries contain only interface-state values. Our implementation does not use them for analytics, advertising, cross-site tracking or user profiling, and the values are not intentionally transmitted by this feature to MyTripoga or to an advertising partner.

A localStorage entry generally remains in the browser until it is deleted by the user or browser. A sessionStorage entry generally expires when the relevant browser session is closed.

More detailed information about cookies and similar technologies used on MyTripoga is provided in the Cookie Policy.

9. Affiliate Links and Travel Partners

MyTripoga participates in travel-related affiliate programs. Some links, buttons, images or other clearly identifiable booking elements may contain affiliate or referral links.

If you follow such a link and subsequently make a booking, purchase or other qualifying transaction with the external provider, MyTripoga may receive a commission. This normally does not increase the price you pay.

Current travel partners

What happens when you follow an affiliate link

Normal affiliate links may contain an affiliate identifier or referral parameter. When you actively click such a link, your browser connects to the affiliate network and/or destination travel provider. At that point technical information such as your IP address, browser information, referrer information and the affiliate identifier may be transmitted to the external provider.

Affiliate networks and travel providers may use their own cookies or similar technologies after you reach their website in order to attribute a booking or transaction to MyTripoga. The subsequent processing is governed by the privacy and cookie information of the respective provider.

MyTripoga may receive referral, transaction or commission reports from affiliate networks. These may include referral identifiers, transaction status, transaction value, commission information and other information necessary to calculate and verify affiliate remuneration.

Processing by MyTripoga for the administration and verification of affiliate relationships may be based on Article 6(1)(f) GDPR. Our legitimate interest is the economic operation and financing of MyTripoga. Processing necessary for tax, bookkeeping or other legal obligations is based on Article 6(1)(c) GDPR.

Where an affiliate technology on MyTripoga itself stores or accesses information on your device or performs non-essential tracking before you leave the website, it is used only after the required consent has been given.

10. Travelpayouts and Embedded Travel Widgets

In addition to ordinary affiliate links, MyTripoga uses embedded travel tools provided through the Travelpayouts affiliate network and associated travel brands. These may include flight search interfaces, date-selection tools, price displays, interactive maps and other travel-search widgets.

When an embedded Travelpayouts or associated travel widget is loaded, the third-party service may receive technical and usage information necessary to display and operate the tool.

Depending on the particular widget, this may include:

• IP address and connectivity information
• Browser and device information
• Language and time-zone settings
• Page and referrer URLs
• Travel searches or search parameters entered into a widget
• Clicks and other interactions with the widget
• Technical error and usage information

The purpose of this processing is to provide the requested travel search or price functionality, measure referrals, attribute bookings or transactions, provide relevant travel results and operate the affiliate tool.

These embedded tools are non-essential third-party content and are loaded only after the required consent has been granted through our consent-management platform. Where consent is required, the legal basis is Article 6(1)(a) GDPR together with Section 25(1) TDDDG.

Travelpayouts is operated by a company established in Hong Kong. Travelpayouts states in its privacy and cookie documentation that personal information covered by its relevant services is stored in the European Union, including in the Netherlands. Depending on the specific tool and underlying travel provider, additional processing or access may nevertheless involve entities outside the European Economic Area.

Further information: Travelpayouts Privacy Policy.

11. Social Media Links

MyTripoga may contain ordinary external links to our profiles on:

• Instagram
• Facebook
• Pinterest
• X

These are simple external links. MyTripoga does not currently embed social-media feeds, social-media login functions, “Like” buttons or advertising pixels from these platforms merely to display the social links.

When you actively click a social-media link, you leave MyTripoga and your browser connects to the respective platform. The privacy rules and data-processing practices of that external platform then apply.

12. Local Fonts and Website Assets

The primary fonts used for the design of MyTripoga are hosted locally on our website infrastructure. Loading these locally hosted fonts does not require a connection to Google Fonts servers.

Other locally hosted design assets, icons and website resources may also be delivered directly from the MyTripoga hosting environment.

Third-party content such as embedded affiliate widgets is treated separately and may load its own technical resources only in accordance with the rules described in the relevant sections of this Privacy Policy and our consent configuration.

13. International Data Transfers

Some service providers used by MyTripoga are established outside Germany or may use infrastructure and sub-processors located outside the European Economic Area (“EEA”).

Where personal data is transferred to a country for which the European Commission has not issued an adequacy decision, an appropriate transfer mechanism is required unless a specific legal exception applies.

Depending on the provider and processing activity, appropriate safeguards may include the European Commission's Standard Contractual Clauses and additional technical or organizational measures.

Hostinger

Hostinger's data-processing arrangements provide for EU Standard Contractual Clauses where customer data is transferred outside the EEA to a country without an adequate level of protection.

Wordfence / Defiant

Defiant, Inc. is established in the United States. Defiant provides contractual data-protection arrangements including EU Standard Contractual Clauses for relevant restricted transfers.

Brevo

Brevo states that its database hosting infrastructure is located within the European Union. Some affiliated companies or sub-processors involved in support, maintenance or other service functions may nevertheless be located outside the EEA. Where a restricted international transfer takes place, the applicable Brevo data-processing arrangements provide for appropriate safeguards, including the European Commission's Standard Contractual Clauses where required.

Travelpayouts and travel providers

Travelpayouts is operated by an entity established in Hong Kong, while Travelpayouts states that relevant personal data covered by its privacy documentation is stored in the European Union. Individual underlying travel providers may be established in other jurisdictions.

Where a third-party integration involves a transfer outside the EEA, the transfer arrangements and safeguards depend on the particular provider and integration. Non-essential embedded travel tools are therefore also subject to our consent-management configuration.

14. Recipients and Categories of Recipients

Personal data is not disclosed to third parties without a legal basis. Depending on the processing activity, recipients or categories of recipients may include:

• Hosting and email infrastructure providers
• Email marketing and newsletter service providers, including Brevo
• Website security providers
• Consent-management providers
• Hosting and authorized technical personnel who operate our locally stored analytics data
• Technical service providers acting on our behalf
• Affiliate networks and travel partners when you use relevant links or tools
• Public authorities where disclosure is legally required
• Professional advisers where necessary to establish, exercise or defend legal claims

Where a service provider processes personal data on our behalf as a processor, we use the required contractual arrangements where applicable.

15. Storage and Deletion of Personal Data

We retain personal data only for as long as necessary for the respective purpose or for as long as required by applicable law. Different processing activities therefore have different retention periods.

In particular:

• Contact inquiries: retained for as long as necessary to process and respond to the inquiry and, where relevant, for subsequent communication or legal retention requirements.
• Newsletter subscriptions: active subscriber data are retained for as long as the newsletter subscription remains active. After withdrawal or unsubscribe, data are removed from active newsletter use. Limited suppression, confirmation or transaction information may be retained for as long as reasonably necessary to document consent and withdrawal, prevent further mailings, comply with legal obligations, or establish, exercise or defend legal claims.
• Server and security information: retained for the period necessary for website security, abuse prevention, troubleshooting and the applicable technical retention settings of our infrastructure providers.
• Consent records: retained for as long as reasonably necessary to demonstrate and document consent decisions and compliance with legal obligations.
• Independent Analytics: locally stored analytics data are configured for automatic deletion after one year. Older data may remain temporarily in rotating website backups until those backups expire.
• Affiliate and commission information: retained for as long as required to verify referrals and commissions and to comply with applicable accounting, tax and statutory retention obligations.
• Backups: personal data contained in website backups may remain within rotating backup copies until those backups expire under the applicable hosting backup schedule.

If you validly request deletion or withdraw consent, personal data will be deleted unless another legal basis or statutory retention obligation requires continued storage.

16. Provision of Data and Automated Decision-Making

Is providing personal data mandatory?

You are generally not legally required to provide personal data in order to browse MyTripoga.

Certain technical information is automatically required to establish a connection between your browser and our server. Without this technical processing, the website cannot be delivered.

If you contact us, some information such as a valid reply address and the content of your inquiry may be necessary for us to respond. Optional form fields are voluntary unless clearly indicated otherwise.

Newsletter subscription is voluntary. A valid email address is required if you want to receive the newsletter; providing a first name is optional. If you do not subscribe or do not complete the double opt-in confirmation, you can continue to use the general editorial content of MyTripoga without restriction.

Consent to website statistics and non-essential third-party technologies is voluntary. Refusing consent does not prevent access to the general editorial content of MyTripoga, although certain embedded external travel tools may not function until the required consent is given.

Automated decisions

MyTripoga does not currently use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR.

17. Your Data Protection Rights

Subject to the requirements and limitations of applicable law, you have the following rights in relation to your personal data:

Objection to direct marketing

Where personal data is processed for direct marketing purposes, you have the right to object to that processing at any time. If you object to processing for direct marketing, your personal data will no longer be processed for that purpose.

Exercising your rights

To exercise your data protection rights, contact: info@mytripoga.com.

We may request information reasonably necessary to verify your identity before acting on a request where this is required to protect personal data from unauthorized disclosure.

18. Right to Lodge a Complaint

If you believe that the processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with a data protection supervisory authority.

The supervisory authority responsible for the location of the MyTripoga controller is:

You may also contact another competent supervisory authority where permitted by the GDPR.

19. Changes to This Privacy Policy

We may update this Privacy Policy where changes to MyTripoga, service providers, technologies, legal requirements or data processing activities make an update necessary.

The current version is published on this page together with the date of the latest update.

If we introduce a materially new processing activity, such as a new advertising platform, analytics service, newsletter provider or other tracking technology, this Privacy Policy and, where required, our consent configuration will be updated before that processing is activated.