Currency
$ USD
LanguageLogin
Last updated: 9 November 2026
Protecting your personal data is important to us. This Privacy Policy explains how triplanet processes personal data when you visit our website, contact us, create an account, request or book travel services, receive communications, take part in promotions or submit content. It also explains your rights under the General Data Protection Regulation (GDPR).
The controller responsible for the activities described in this Privacy Policy is Marcel Franke, trading as triplanet (sole proprietorship), Franz-Ehrlich-Str. 12, 12489 Berlin, Germany. Email: info@triplanet.com; telephone: +49 (0)30 814 55 16 29.
For questions or requests concerning your data, please use the contact details above. Where a different entity, such as a tour operator, independently decides how to use information for its own contracted travel services, that entity is responsible for its own data protection notice and processing.
This policy applies to website visitors, customers, prospective customers, registered account holders, people who communicate with us, participants in promotions, and travellers whose personal data is provided to us by another person making a booking. Where we receive data about a traveller from someone else, we may need to provide that traveller with additional information under Article 14 GDPR.
Independent tour operators, airlines, insurers, payment service providers and certain digital platforms may process information as separate controllers under their own privacy notices. The responsibilities of each party depend on the relevant processing activity and contractual arrangements.
Depending on how you interact with triplanet, we may process the following categories:
We ask you not to include unnecessary sensitive details in ordinary contact messages. Additional information required directly by a tour operator may be collected by that operator under its own privacy notice.
We process personal data for the purposes and on the legal bases set out in this policy:
Special categories of personal data, including health information, require an additional applicable condition under Article 9 GDPR and are not collected merely because a customer checks a general tour-suitability acknowledgement. We request explicit consent separately where that is the condition relied upon.
We process IP addresses, request times, accessed resources, device/browser metadata, error events and security signals as necessary to deliver the website, detect attacks and maintain operational integrity (Article 6(1)(f) GDPR). Data that is technically required for a service expressly requested by the visitor may also be processed under Article 6(1)(b) GDPR where applicable.
Our new website is based on Wagtail and uses AWS infrastructure with the production environment intended to be hosted in the Frankfurt region. Administration, support access, backups and third-party email or logging services can have other locations. The definitive provider and location configuration is determined by the actual production deployment and the applicable service contracts.
Non-essential analytics and advertising technologies are subject to the separate consent arrangements described below. The fact that a website server is based in the EU does not rule out access to personal data from other countries.
If you register an account, we process the account information and login-related data needed to create and maintain the profile, authenticate access, associate bookings and manage your preferences. The principal legal basis is Article 6(1)(b) GDPR. Security records may also be processed under Article 6(1)(f) GDPR.
You can request correction or deletion of your account information by contacting us. Some booking, payment and accounting records may have to be retained separately due to legal obligations or outstanding claims. Deleting an account does not automatically cancel a confirmed travel contract.
When you contact us by email, telephone, website form or another channel, we process your contact details and the content of your message in order to respond, prepare quotations, advise on available services, or handle follow-up questions. The legal basis is Article 6(1)(b) GDPR where you request pre-contractual steps or contractual assistance, and otherwise Article 6(1)(f) GDPR where our legitimate interest in communicating with you applies.
Messages may be recorded in customer support systems and, where relevant, our CRM to avoid losing important information and provide continuity of service. We do not require consent merely to respond to a request you initiate, unless a separate consent-based activity is involved.
When you book or request a tour, we process the personal and booking details needed to arrange the selected services, confirm eligibility, collect payments, communicate with the tour operator and provide customer support. Depending on the selected trip, we share relevant details with the responsible organiser and its authorised booking or local service partners.
Operators available through triplanet may include Intro Travel, TruTravels, One Life Adventures, G Adventures, Welcome to Travel, Ultimate Travel and other tour operators shown with the relevant trip. The identity of the applicable operator is displayed during the booking process. Each operator may process data as an independent controller for fulfilling the tour contract and complying with its own legal obligations.
Some operators or booking partners are located outside the European Economic Area. We transfer only the information reasonably necessary for booking and travel administration and assess the appropriate mechanism for each transfer, as explained below.
The main legal basis for our own booking-related processing is Article 6(1)(b) GDPR. Other travellers' information supplied by the lead booker may also be processed as required for providing and administering the booking, subject to the applicable lawful basis and the information obligations owed to those travellers.
To arrange travel, we process the traveller's name, date of birth when required, nationality, contact and booking information, travel preferences and, when necessary, passport or entry-related details. For contract-related processing we rely primarily on Article 6(1)(b) GDPR and relevant legal duties under Article 6(1)(c) GDPR. When the lead booker supplies details of fellow travellers, we process those details for the requested booking and provide or make available the relevant information notices, taking Article 14 GDPR into account where applicable.
Customers can voluntarily provide emergency contacts, dietary preferences, mobility needs or medical information, or can give these details directly in the operator's booking portal. Health and disability details may qualify as special categories of personal data. We process or forward them only where there is an applicable Article 6 legal basis and a valid exception under Article 9(2) GDPR, in particular explicit consent where appropriate or another legally applicable exception. Providing a generic acknowledgement in the checkout is not explicit consent to process health data. We limit access and disclosure to what the relevant operator or service provider needs.
Where a customer provides an emergency contact's details, those details are used solely for the travel-related emergency purpose and shared only as necessary. The operator may be a separate controller under its own privacy information.
We process payment-related data, such as booking reference, amount, currency, transaction identifiers, payment status, billing details and refund or chargeback information, to facilitate deposits, instalments and final payments and to keep the necessary financial records. Our legal bases are Articles 6(1)(b) and 6(1)(c) GDPR and, where appropriate, Article 6(1)(f) GDPR for fraud prevention and payment disputes.
Depending on the checkout selection, payments are processed through Stripe, PayPal or bank transfer. The relevant payment provider processes information in accordance with its own privacy notice and payment-services obligations; we do not need to store full card numbers to administer a booking. Bookkeeping and customer invoices may be processed using sevDesk and our financial or tax advisers. Only data necessary for those functions are shared.
We use HubSpot as our customer relationship management system for enquiries, customer communications, booking history, preferences, consent records and administration. We use Superchat for customer conversations, including communication through WhatsApp where chosen, and Fonial for telephone services. Depending on the selected channel, communications metadata, contact details and messages may be processed by the service provider. WhatsApp and Meta may process data under their own applicable terms and privacy notices.
We use these systems to respond to enquiries and administer requested travel services (Article 6(1)(b) GDPR), fulfil applicable legal duties (Article 6(1)(c)) and manage proportionate customer support and security (Article 6(1)(f)). Marketing content is governed by consent or another specifically documented lawful basis; using a customer service channel alone does not authorise unrelated promotional messages.
We send transaction-related notifications, including booking requests, actual confirmations, deposit and balance notices, payment failures, invoices, departure updates, cancellation notices and refunds. These messages are necessary for the requested booking or legal compliance and are normally based on Article 6(1)(b) or (c) GDPR.
Messages that primarily advertise future bookings, special offers, voucher rewards or unrelated travel promotions are treated as marketing, even if they are presented in an automated booking-email template. A recipient's newsletter withdrawal does not stop genuinely necessary transactional messages; it must, however, be respected for marketing communications unless a separate lawful basis applies.
For an opted-in newsletter, we process email address, optional name and language, consent evidence and, where the service is enabled, engagement data. The normal basis is consent under Article 6(1)(a) GDPR. Subscriptions and unsubscribe preferences are managed through HubSpot, with confirmation evidence retained to the extent necessary to establish that messages were permitted.
We operate birthday voucher, loyalty, referral and other promotional programmes. Sending a birthday promotion, a booking-abandonment reminder offering to complete a purchase, an anniversary promotion or a reactivation offer by email is electronic marketing when its content is promotional. We send such messages only where there is valid consent or an applicable and documented statutory exception for existing customers, including any conditions and opt-out requirements under section 7 UWG. Participation in a tour, knowledge of a date of birth or an unsubscribe link alone do not constitute advertising consent.
Recipients can unsubscribe from promotional email at any time using the relevant unsubscribe link or by contacting us. Withdrawing marketing consent does not affect contractual travel communications.
We may request service feedback and invite customers to leave reviews, including via Trustpilot. Depending on the implemented invitation method, we may transmit the data required to send or verify an invitation, such as an email address, name or order reference. Trustpilot may process some information as an independent controller; its own privacy information applies when customers interact with Trustpilot.
Review invitations sent by email must also comply with applicable rules on electronic advertising. We use internal customer feedback for service quality under Article 6(1)(f) GDPR where our interests do not override the individual's rights.
When you participate in a promotion or redeem a voucher, we may process your name, email address, participation records, booking details, eligibility, voucher code, redemption status and winner communications. These are used to administer the offer, prevent misuse and fulfil the programme conditions. The legal basis is normally Article 6(1)(b) GDPR for participation arrangements, Article 6(1)(f) GDPR for appropriate abuse prevention, and Article 6(1)(c) GDPR where legal obligations apply.
Different promotional activities may have additional notices or specific consents, particularly where participant content is to be published commercially. Taking part in a prize contest does not, by itself, subscribe you to unrelated email marketing.
Customers may voluntarily submit travel photos and videos for competitions, testimonials or specifically agreed content uses. To administer submissions, we process the files, the contributor's identification and contact details, contest eligibility and evidence of applicable permissions. File uploads may be handled through a Dropbox File Request.
Publishing or using photos and videos of identifiable individuals, including for advertising, requires a valid legal basis and respect for copyright, personality and data protection rights. A contributor's statement that other people have agreed does not by itself replace the legal permission required for those people. We may request additional releases, restrict publication, or remove content where permissions are not sufficiently established.
The relevant contest and content-usage terms are made available for the programme. Where consent is relied on, applicable withdrawal and erasure rights remain available. Copyright permissions and data protection permissions are distinct.
The website uses strictly necessary technologies to provide requested functions such as session security, language, currency and basic checkout operation. Non-essential cookies, local storage, pixels and equivalent access to terminal equipment are used only with the consent required under section 25 TDDDG. Any related processing of personal data must also have a GDPR legal basis.
Our website consent mechanism is operated using CookieYes. It presents information about the available categories and providers, records the user's choices and permits withdrawal or changes to choices via the cookie settings control. Only technologies that are strictly necessary for a service expressly requested by the visitor may be activated without the consent otherwise required by law.
For up-to-date details of the individual cookies and storage technologies in use, including provider, purpose, retention and category, please consult the live cookie preference interface and its cookie list. The list is supplementary to this Privacy Policy; its settings must match the scripts actually deployed on the website.
When analytics consent is given, the website may use Google Analytics 4 through Google Tag Manager to measure page usage, booking funnel activity and general performance. Depending on the configuration, this can include page views, clicks, referral sources, approximate device data, consent signals and selected booking events. We use the information to improve usability, understand demand and assess marketing performance (Article 6(1)(a) GDPR where consent is required).
Analytics identifiers and session-based information are processed according to the retention and consent settings in the live deployment. Where the relevant measurement is not enabled, it does not run. Visitors can withdraw consent through the cookie settings control.
Where activated and allowed by the relevant consent preferences, we use advertising measurement and attribution services provided by Google Ads and Meta, potentially involving browser tags, conversion events, identifiers, attribution metadata, booking values and consent signals. Depending on the implemented arrangement, tags and conversion data may also be processed through stape.io server-side tagging.
The necessary consent choices govern both browser-side and server-side advertising operations. Server-side tagging does not override a refusal or withdrawal of consent. We do not use medical details, passport numbers or other unrelated confidential booking data for marketing attribution.
Other advertising services, such as TikTok or Microsoft Advertising, are not included in this description as currently active services. If introduced, we will update the consent information and this notice before their use as legally required.
Our websites and emails link to profiles on Facebook, Instagram and YouTube and may include embedded videos, social media features or a Trustpilot review widget. A link is activated when you follow it; embedded third-party elements may transfer technical data such as your IP address and browser information when loaded. Embedded components that require consent are not loaded before that consent is given.
If you leave a review on Trustpilot or use an external social platform, the relevant provider processes your data under its own notices. Any review invitations initiated by triplanet are assessed separately under the applicable marketing and data protection rules.
We disclose personal information only where necessary for the requested service or another lawful purpose, potentially to the following recipients:
Recipients may be processors acting on our instructions, independent controllers or other lawful contracting partners. We limit disclosure to the information needed for the particular service; not every recipient receives every category of data.
Group tours are arranged internationally, and necessary traveller details may therefore be sent to travel operators, airlines, accommodation providers and local service providers outside the European Economic Area (EEA). Some technology suppliers or development and support teams may also have access from outside the EEA, even where servers are based in Germany.
Transfers are assessed in accordance with Chapter V GDPR. Depending on the recipient and the purpose, a legal transfer mechanism may be an EU adequacy decision (including a recognised mechanism for an eligible recipient), European Commission standard contractual clauses with required additional measures, or a narrowly applicable exception under Article 49 GDPR for a transfer necessary for the requested travel contract. A general publication of this notice does not itself establish that the necessary contractual transfer safeguards are in place.
For information about recipients and applicable safeguards in an individual case, contact info@triplanet.com.
We retain personal data for the period necessary for the specific service, applicable retention obligations and the establishment, exercise or defence of legal claims. The main criteria are:
When data is no longer needed and no legal retention reason applies, it is erased or anonymised. We review deletion requests individually where an immediate erasure is restricted by a statutory duty.
We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse and alteration. These measures may include encrypted transmission, access controls, security logging, role-based permissions, backups and contractual safeguards with service providers. No online system can guarantee absolute security.
Subject to the applicable legal conditions, you have the rights to access your personal data (Article 15 GDPR), rectify inaccurate information (Article 16), request erasure (Article 17), restrict processing (Article 18), obtain portability for qualifying information (Article 20), object to processing based on legitimate interests and to direct marketing (Article 21), and withdraw consent with future effect where consent was the legal basis (Article 7(3)).
You may complain to a supervisory authority (Article 77 GDPR). For triplanet the regional supervisory authority is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, Germany, www.datenschutz-berlin.de, email mailbox@datenschutz-berlin.de. You may also contact another competent supervisory authority.
Contact us at info@triplanet.com to exercise your rights. We may request proportionate identity confirmation if needed, and respond within statutory deadlines. A withdrawal does not affect the lawfulness of processing before withdrawal.
We need certain personal data to handle enquiries, form travel contracts, check tour eligibility, take payments or meet legal obligations. If necessary information is not provided, we may be unable to provide the relevant service. Optional marketing preferences and voluntary special requirements are not prerequisites for general website use.
The person submitting a booking must be 18 or over. Certain tours may include minor travellers where the operator permits this and the applicable parental or guardian requirements are met. We do not intentionally collect children's data for independent promotional accounts.
We do not use automated decisions producing legal or similarly significant effects within the ordinary travel booking process without providing the information and safeguards required by Article 22 GDPR. Automated reservation status checks and email dispatch do not by themselves establish such a decision.
We may update this Privacy Policy when our services, legal requirements or data processing activities change. The current version will be made available on our website with an updated date. Where required, we will provide additional notice or obtain new consent before materially changing a consent-based processing purpose.
Marcel Franke, trading as triplanet
Franz-Ehrlich-Str. 12, 12489 Berlin, Germany
Email: info@triplanet.com