This policy explains what personal data Alesia Atlas collects when you use alesia-atlas.pro, why we collect it, how long we keep it, who we share it with and what rights you have. It applies to visitors from the European Union and the European Economic Area under the General Data Protection Regulation (GDPR), wherever our company is based.
1. Who is responsible for your data
The controller for this website is:
—
—
—
Email: dev-email@wpengine.local
Phone: —
For any privacy question or request, write to dev-email@wpengine.local.
2. Our role
Alesia Atlas is a travel marketplace. We present multi-day tours run by independent tour operators and help you book them through our booking partner TourRadar. We are not the organiser of the tours. When you book, your contract is with the tour operator and/or TourRadar, and they process your booking data under their own privacy policies. See our Terms of Use and Affiliate Disclosure.
3. What data we collect and why
3.1 Visiting the website
When you open a page, our web server automatically records technical data: IP address, date and time, page requested, referring page, browser and device type. We need this to deliver the site and keep it secure (legal basis: our legitimate interest, Art. 6(1)(f) GDPR). Server logs are kept for a short period, normally no longer than 30 days, unless needed to investigate an attack.
3.2 Booking requests
When you request a booking or a payment link we collect your name, email address, phone number (optional), the tour, departure date, number of travellers, room choice and any message you write. We use this to check availability, prepare your booking with the tour operator through TourRadar, send you a secure payment link and answer your questions (legal basis: steps prior to a contract at your request, Art. 6(1)(b) GDPR). We keep booking requests for 24 months after the last update, then delete them automatically, unless tax or accounting law requires us to keep them longer.
3.3 Emails and contact
If you write to us, we use your email address and message to reply (Art. 6(1)(b) or (f) GDPR) and keep the conversation as long as needed to handle your request.
3.4 Newsletter
If we offer a newsletter, we only send it after you confirm your subscription by clicking a link in a confirmation email (double opt-in, Art. 6(1)(a) GDPR). Every newsletter contains an unsubscribe link, and you can withdraw your consent at any time.
3.5 Cookies, analytics and partner tracking
Necessary cookies are set without consent because the site cannot work without them. Analytics and marketing (affiliate) cookies are only set after you agree in our cookie banner (Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy Directive). Details are in our Cookie Policy.
3.6 Maps
Tour route maps load map tiles from OpenFreeMap and elevation data from Amazon Web Services (open terrain tiles). To deliver these images your browser sends your IP address to these providers. No cookies are set. Legal basis: our legitimate interest in showing the route of a tour (Art. 6(1)(f) GDPR).
3.7 Videos
Tour videos from YouTube (privacy-enhanced mode, youtube-nocookie.com) or Vimeo (do-not-track mode) only load after you click play. From that moment the provider receives your IP address and may set its own cookies.
4. Who receives your data
- TourRadar and the tour operator of your tour, to handle your booking and payment.
- Our hosting and email providers, who process data on our behalf under data processing agreements.
- Analytics or marketing providers, only if you consented to them in the cookie banner.
- Authorities, only where the law requires it.
We never sell your personal data.
5. Transfers outside the EU
Some recipients may be located outside the EU/EEA (for example in Turkey or the United States). Where a country has no EU adequacy decision, we use the European Commission’s Standard Contractual Clauses or, for US companies, certification under the EU-U.S. Data Privacy Framework. You can request a copy of these safeguards from us.
6. How long we keep data
- Server logs: up to 30 days.
- Booking requests: 24 months after the last update.
- Records of your cookie choice: 24 months (anonymised IP, no name).
- Invoices and accounting records: as long as tax law requires.
7. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you (Art. 15);
- have incorrect data corrected (Art. 16);
- have your data deleted (Art. 17);
- restrict processing (Art. 18);
- receive your data in a portable format (Art. 20);
- object to processing based on legitimate interest (Art. 21);
- withdraw any consent at any time, without affecting earlier processing (Art. 7(3)).
To use these rights, email dev-email@wpengine.local. We answer within one month. You also have the right to complain to a data protection supervisory authority, in particular in the EU country where you live or work. Our lead authority is: —.
8. Security
The site is served over an encrypted (HTTPS) connection. Access to booking data is limited to staff who need it, and payments are never processed on our site but on the secure checkout of our booking partner.
9. Children
Our services are not directed at children under 16. Bookings for minors must be made by a parent or guardian.
10. Changes
We update this policy when our services or the law change. The date at the top shows the latest version.