Skip to main content

Privacy Policy

Last updated: September 2, 2025

Only the German version of this Privacy Policy is legally binding; translations are provided solely for easier understanding.

1. Controller

The Kölsch Crew, Owner: Michael Piel
Schmiedegasse 30, 50735 Cologne, Germany
Phone: 0221 66994069
Email: tours@koelschcrew.com
(Hereinafter: “we”, “us”)

A data protection officer has not been appointed, as the legal requirements are currently not met (Art. 37 GDPR).

2. Terms & Legal Basis

  • Personal Data means any information relating to an identified or identifiable natural person (Art. 4 No. 1 GDPR).
  • Processing means any operation performed on personal data (Art. 4 No. 2 GDPR).
  • Legal Basis: Art. 6 para. 1 lit. a (consent), lit. b (contract/initiation), lit. c (legal obligation), lit. f (legitimate interest) GDPR.
  • TTDSG: For setting/reading not strictly necessary cookies or similar technologies, consent according to § 25 para. 1 TTDSG is required. We base technically necessary cookies on § 25 para. 2 TTDSG.

3. Hosting, Log Data & Security

We host frontend and backend in the EU with a professional provider (STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin). When you access our pages, the server automatically collects log data:

  • IP address, date/time, time zone, status code, referrer URL, retrieved resources/URLs, user agent (browser, OS, device).
    Purposes: Operation, security (e.g., attack defense), error analysis (Art. 6 para. 1 lit. f GDPR).
    Storage duration: usually 7–30 days, then deletion/anonymization, unless security-relevant retention is necessary.

4. Obligation to Provide / Consequences of Non-Provision

The provision of certain data (e.g., for a booking) is required for contractual purposes. Without this data, the service cannot be provided.

5. Cookies & Consent Management

We use a consent banner (CMP) that manages your consents for Analytics/Marketing.

  • Technically necessary cookies (e.g., session, language, shopping cart/booking context): Use without consent (§ 25 para. 2 TTDSG, Art. 6 para. 1 lit. f GDPR).
  • Non-essential cookies (Analytics/Marketing): only with consent (§ 25 para. 1 TTDSG, Art. 6 para. 1 lit. a GDPR).
  • Revocation/Adjustment: You can change your settings at any time via the “Cookie Settings” link in the footer.

Multilingualism (WPML): To provide the selected language, we use cookie/storage entries (legitimate interest in user-friendly presentation, Art. 6 para. 1 lit. f; § 25 para. 2 TTDSG).

6. Contact (Form, Email, Phone)

When you contact us (form, email, phone), we process your information (name, contact details, inquiry content, metadata) for processing and, if necessary, follow-up questions.
Legal Basis: Art. 6 para. 1 lit. b (pre-contractual/contractual) or lit. f (general inquiries).
Storage duration: until your inquiry is completed; statutory retention periods remain unaffected.
Email Sending: We send emails via Microsoft 365/Exchange Online (Germany/EU; standard contractual clauses for third-country transfers).

7. Bookings via Recras (iFrame)

We integrate booking processes from the external provider Recras B.V. (Helperpark 284-2, 9723 ZA Groningen, Netherlands) via iFrame. When used, data is transmitted directly to Recras (including name, contact details, booking details, payment method).
Purposes/Legal Basis: Implementation of pre-contractual measures and fulfillment of contract (Art. 6 para. 1 lit. b GDPR).
Note: Recras’s data protection regulations apply to processing by Recras. We have a data processing agreement with Recras (if acting as a processor) or base the transfer on Art. 6 para. 1 lit. b GDPR (if Recras acts as its own controller, e.g., payment processing).

8. Payments

Payments are made depending on the offer online (e.g., via Mollie, Keizersgracht 126, 1015CW, Amsterdam, Netherlands) or by invoice/advance payment.

  • Online Payments via Mollie B.V. (Netherlands): Processing of payment data, transaction IDs, amounts, and, if applicable, risk assessment. Legal Basis: Art. 6 para. 1 lit. b GDPR.
  • Invoice/Advance Payment: Processing of your invoice/company data, payment status. Legal Basis: Art. 6 para. 1 lit. b; retention according to HGB/AO (Art. 6 para. 1 lit. c).

If you also offer PayPal/Klarna/Sofort etc., you can optionally retain the passages from your old declaration; otherwise, please remove them.

9. Analytics & Measurement

9.1 Google Analytics 4 (GA4) Incl. Consent Mode V2

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
We use GA4 for audience measurement and website improvement. IP addresses are truncated; GA4 works with events/IDs.
Technical Basis: Cookies/Storage only with consent (§ 25 para. 1 TTDSG). Legal Basis: Art. 6 para. 1 lit. a GDPR (revocation at any time via Cookie Settings).
Data Transfer: Processing in the USA cannot be ruled out (Google LLC). Google bases transfers on EU Standard Contractual Clauses; additionally, we implement the data protection settings provided by GA4 (e.g., IP masking).
Storage duration for GA4: user-/event-related, usually 2–14 months (depending on configuration).

9.2 Google Ads / Conversion Tracking (Optional)

When campaign measurement is activated, we set Google Ads tags.
Legal Basis: Consent (Art. 6 para. 1 lit. a; § 25 para. 1 TTDSG).
Purpose: Success measurement and optimization of advertisements; possible third-country transfer to Google LLC (USA) based on SCC.

9.3 Meta Pixel (Facebook)

If activated, we use the Meta Pixel for campaign measurement/optimization.
Legal Basis: Consent (Art. 6 para. 1 lit. a; § 25 para. 1 TTDSG).
Joint Controllership: if applicable, Art. 26 GDPR with Meta Platforms Ireland; third-country transfers to Meta Platforms, Inc. (USA) based on SCC.

10. Embedded Content & Services

10.1 Google Maps

When maps are displayed, your IP address and, if applicable, other technical data are transmitted to Google (see above).
Legal Basis: Consent (Art. 6 para. 1 lit. a; § 25 para. 1 TTDSG), as cookies/storage are regularly required for display.

10.2 reCAPTCHA

To protect against spam/automation, we use Google reCAPTCHA.
Legal Basis: legitimate interest (Art. 6 para. 1 lit. f) in security; insofar as cookies/storage are required: consent according to § 25 para. 1 TTDSG.

10.3 YouTube/Vimeo (if Embedded)

When playing/embedding, data is transmitted to the respective provider.
Legal Basis: Consent (Art. 6 para. 1 lit. a; § 25 para. 1 TTDSG).

11. Newsletter/Remarketing

Upon registration, we process your email address for sending; double opt-in, logging of consent.
Legal Basis: Art. 6 para. 1 lit. a GDPR; revocation at any time via unsubscribe link.
Remarketing/similar target groups exclusively with consent (Art. 6 para. 1 lit. a; § 25 para. 1 TTDSG).

12. Applications

For applications, we process application/communication data for selection purposes (Art. 6 para. 1 lit. b, § 26 BDSG; with consent, e.g., talent pool: Art. 6 para. 1 lit. a).
Storage duration: generally 6 months after completion; longer retention only with consent or legitimate interest (e.g., legal defense).

13. Recipients & Data Categories

  • IT/Hosting Service Providers, Maintenance (EU/EEA)
  • Email/Communication: Microsoft 365/Exchange Online
  • Analysis/Marketing (optional): Google (Analytics/Ads), Meta (Pixel), Hotjar
  • Booking/Payment: Recras, Mollie
  • Authorities/Tax Advisors/Accounting: as far as legally required
    Legal Basis: Art. 6 para. 1 lit. b, lit. c or lit. f; for third-country transfers, use of SCC and additional measures, as necessary.

14. Storage Durations

We process and store personal data only as long as necessary for the purposes or as long as legal obligations exist (HGB/AO usually 6–10 years for tax-relevant documents).

15. Rights of Data Subjects

You have the following rights vis-à-vis us:
Information (Art. 15), Rectification (Art. 16), Erasure (Art. 17), Restriction of Processing (Art. 18), Data Portability (Art. 20), Objection (Art. 21), Withdrawal of granted consents (Art. 7 para. 3).
To exercise these rights, a message to tours@koelschcrew.com is sufficient.

Right to Lodge a Complaint: You can lodge a complaint with a data protection supervisory authority, e.g., with the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW).

16. Third-Country Transfers

If providers in third countries (especially USA) process data, this is done on the basis of an adequacy decision (if available) or the EU Standard Contractual Clauses including additional measures. Residual risks cannot be completely excluded.

17. Minors

Our services are not directed at persons under 16 years of age. Use of services requiring consent requires the approval of the legal guardians.

18. Changes to this Privacy Policy

We will adapt the policy if our processing operations, services, or the legal situation change. The current version is available on this website.