Privacy Policy

1. Controller

This website is operated by KM Sped & Travel GmbH, trading as KM Europe Holiday.

• Company: KM Sped & Travel GmbH
• Address: Malzstrasse 2, 2320 Schwechat, Austria
• Email: ray@km-europeholiday.com
• EU VAT: ATU77768578

2. Data We May Process

• Website access data such as IP address, browser type, device information, pages visited, and server logs.
• Inquiry data you voluntarily provide, such as name, contact details, travel dates, group size, preferences, budget, and message content.
• Travel arrangement data needed to perform confirmed services, such as flight details, accommodation details, passport copies, or other required service information.
• Messages sent through third-party platforms such as WhatsApp, Line, or Facebook, which are also processed under those platforms' own policies.

3. Purposes and Legal Bases

We process data to answer inquiries, prepare quotations, plan and perform travel services, maintain website security, and comply with accounting, tax, and legal obligations.

4. Online Bookings and Payment

When you book a tour online, we process the lead passenger's name, email address and phone number, the tour, departure date and party size, your chosen payment currency, whether you selected a one-way trip, and any special requests you enter. This data is stored in a Cloudflare D1 database restricted to the European Union. The legal bases are performance of a contract (Art. 6(1)(b) GDPR) and legal obligation (Art. 6(1)(c)).

We use the following processors to complete online bookings:

• Stripe Payments Europe, Ltd. (Ireland): payment and refund processing. Your card details are sent by your browser directly to Stripe and never pass through or rest on our servers. Stripe also acts as an independent controller for purposes such as fraud prevention — see the Stripe Privacy Policy.
• Brevo (Sendinblue SAS, France): sends our transactional email — booking confirmations, vouchers and refund notices — and receives your name and email address for that purpose. See the Brevo Privacy Policy.
• Cloudflare, Inc.: website and database hosting. The booking database is configured to store and process data within the EU only.

Retention: special-request text is deleted automatically 3 months after booking (it can contain more sensitive personal information); name, email and phone are deleted automatically 24 months after booking; transaction and invoice records without personal contact data are kept for the statutory retention period under Austrian tax law (currently 7 years).

5. Your Rights

Where GDPR and Austrian data protection law apply, you may have rights to access, rectify, erase, restrict, transfer, or object to processing of your personal data. You may also lodge a complaint with the Austrian Data Protection Authority.

Austrian Data Protection Authority:https://dsb.gv.at/