Privacy Policy

1. Controller

This website is operated by KM Sped & Travel GmbH, trading as KM Europe Holiday.

• Company: KM Sped & Travel GmbH
• Address: Malzstrasse 2, 2320 Schwechat, Austria
• Email: ray@km-europeholiday.com
• EU VAT: ATU77768578

2. Data We May Process

• Website access data such as IP address, browser type, device information, pages visited, and server logs.
• Inquiry data you voluntarily provide, such as name, contact details, travel dates, group size, preferences, budget, and message content.
• Travel arrangement data needed to perform confirmed services, such as flight details, accommodation details, passport copies, or other required service information.
• Messages sent through third-party platforms such as WhatsApp, Line, or Facebook, which are also processed under those platforms' own policies.

3. Purposes and Legal Bases

We process data to answer inquiries, prepare quotations, plan and perform travel services, maintain website security, and comply with accounting, tax, and legal obligations.

4. Online Bookings and Payment

When you book a tour online, we process the lead passenger's name, email address and phone number, the tour, departure date and party size, your chosen payment currency, whether you selected a one-way trip, and any special requests you enter. This data is stored in a Cloudflare D1 database restricted to the European Union. The legal bases are performance of a contract (Art. 6(1)(b) GDPR) and legal obligation (Art. 6(1)(c)).

We use the following processors to complete online bookings:

• Stripe Payments Europe, Ltd. (Ireland): payment and refund processing. Your card details are sent by your browser directly to Stripe and never pass through or rest on our servers. Stripe also acts as an independent controller for purposes such as fraud prevention — see the Stripe Privacy Policy.
• Brevo (Sendinblue SAS, France): sends our transactional email — booking confirmations, vouchers and refund notices — and receives your name and email address for that purpose. See the Brevo Privacy Policy.
• Cloudflare, Inc.: website and database hosting. The booking database is configured to store and process data within the EU only.

Retention: special-request text is deleted automatically 3 months after booking (it can contain more sensitive personal information); name, email and phone are deleted automatically 24 months after booking; transaction and invoice records without personal contact data are kept for the statutory retention period under Austrian tax law (currently 7 years).

Booking-form statistics: to understand where people stop while booking, we count anonymous steps in the booking form (for example, how many people opened it and how many chose a date). These counts contain no name, email, phone number, IP address or any other identifier, are not linked to your booking, cannot be traced back to you, and are never shared. They use no cookies and no cross-site tracking, and are deleted after 12 months.

5. Cookies and Analytics

This website uses no marketing or advertising cookies, and no cross-site tracking tools such as Google Analytics or Meta Pixel. We use only two forms of cookieless, anonymous measurement:

• Cloudflare Web Analytics: anonymous traffic statistics provided by our hosting provider (page views, referring site, country, device type). It sets no cookies, creates no cross-site identifier, and does not follow individual visitors.
• Booking-form statistics:anonymous counts of the booking form steps, described under “Online Bookings and Payment” above.

If we later add analytics or marketing tools that require consent, this policy will be updated and the necessary consent or opt-out options provided.

6. Your Rights

Where GDPR and Austrian data protection law apply, you may have rights to access, rectify, erase, restrict, transfer, or object to processing of your personal data. You may also lodge a complaint with the Austrian Data Protection Authority.

Austrian Data Protection Authority:https://dsb.gv.at/