Privacy

This privacy policy informs you about which personal data we process when you visit flug-123.de, for what purposes, on what legal basis and for how long. You will also learn what rights you have. For bookings made through our travel search, the privacy policy of our partner travianet also applies (section 6).

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

For all questions about data protection and for exercising your rights, please write to info@flug-123.de.

2. Overview

• Our website consists of static pages. We use no cookies, no tracking, no analytics tools and no advertising or social media plug-ins.
• Fonts are stored locally on our server. No data is transferred to font providers when a page is loaded.
• Your choice between day and night view, your saved destinations and ticked items in checklists are stored only locally in your browser (section 7).
• We only load the booking engine of our partner travianet when you click “Show offers” (section 6).
• We do not offer customer accounts. We only collect data if you write to us or call us.
• The connection to our website is encrypted with TLS (recognisable by “https://” and the padlock symbol in your browser).

3. Hosting and server log files

Our website and our email mailboxes are operated by the hosting provider cheaptophost.com. The servers are provided by a specialised data centre operator based in the United Kingdom and are located in a data centre in the United Kingdom. The data centre operator processes the data exclusively on our behalf and in accordance with our instructions; a data processing agreement pursuant to Art. 28 GDPR has been concluded with it. So that pages load quickly, content may be delivered via a content delivery network. Visitors outside the EU may be served from servers outside the EU.

For the United Kingdom, there is an adequacy decision of the European Commission (Art. 45 GDPR), which was extended in December 2025 until 27 December 2031. The level of data protection there is therefore recognised as equivalent.

Each time our website is accessed, the server automatically processes the following data in so-called log files:

• IP address of the requesting device,
• date and time of access,
• page or file requested, amount of data transferred and HTTP status code,
• the previously visited page (referrer), if your browser transmits it,
• browser type, browser version and operating system.

Purpose: delivery of the website, ensuring technical operation, defence against attacks and error analysis.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure and functioning website).
Storage period: The log files are deleted automatically, at the latest after twelve weeks, unless they are needed for longer in an individual case to investigate a specific security incident. They are not combined with other data or evaluated for advertising or analysis purposes.

4. Contact by email or phone

If you contact us by email or phone, we process your details (for example name, email address, phone number and the content of your message) in order to answer your enquiry. Our email mailboxes (info@flug-123.de and support@flug-123.de) are hosted by our hosting provider cheaptophost.com (section 3).

Legal basis: Art. 6(1)(b) GDPR if your enquiry relates to a contract or steps prior to entering into one; otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries).
Storage period: We delete the enquiry once it has been fully dealt with and no statutory retention obligations apply (section 9).

Phone and phone assistant with artificial intelligence

For phone calls, we use our own telephony and customer service platform saasvisionary.com, a service of our company. If none of us is available, the call is answered by a phone assistant that works with artificial intelligence. It tells you so at the start of the call. The assistant takes down your request, answers general questions and passes your request on to us.

In doing so, we process your phone number, the time and duration of the call and, for conversations with the assistant, the content of the conversation, a transcript made from it and a summary.

Service providers: The technical operation of the platform is carried out by processors based in the USA with whom contracts pursuant to Art. 28 GDPR have been concluded. These include the operator of the platform infrastructure, the database and storage service Supabase, Inc., Cloudflare, Inc. (network and delivery) and OpenRouter, Inc. (forwarding to AI language models; use of your data to train the models is excluded), as well as the providers of the phone connection and of the assistant’s voice. The complete, current list is available at saasvisionary.com/legal/subprocessors. Transfers to the USA are covered by the standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR); where a service provider is certified under the EU-US Data Privacy Framework, there is also an adequacy decision of the European Commission (Art. 45 GDPR).

Legal basis: as above (Art. 6(1)(b) or (f) GDPR; legitimate interest in taking requests even when none of us is available). If you do not wish to speak to the assistant, simply end the call and send us an email.
Storage period: We delete the call data once your request has been fully dealt with and no statutory retention obligations apply (section 9).

5. Airport suggestions in the search form

When you type a place into the “Flight” tab of the search form, we suggest matching airports and cities. For this, your browser sends the search term you entered to our server. Our server requests the suggestions from the flight data service Duffel Technology Limited (London, United Kingdom). We only transmit the search term, not your IP address or any other information about you. We do not store the search term.

To protect against misuse, we limit the number of requests per visitor. For this purpose, we create an encrypted checksum from your IP address, from which the IP address cannot be recovered, and delete it after ten minutes.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a convenient search that is protected against misuse).

6. Travel search and booking via our partner travianet

You search for and book package holidays, hotels, flights and car hire on our “Travel search” page in the booking engine of travianet GmbH, Angermühle 8a, 94469 Deggendorf. The booking engine is embedded in our page and loaded from travianet’s servers.

Only after you click: We only load the booking engine when you click “Show offers”. From then on, data is transferred to travianet: your IP address, information about your browser and device, and your search details from our search form (destination, departure airport, travel dates, number of travellers and ages of children). travianet may store information on your device or read it from your device. We only remember your decision for the open browser window in the so-called session storage (section 7); when you close the window, we ask again on your next visit.

Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG, the German Telecommunications Digital Services Data Protection Act). You can withdraw it at any time with effect for the future by closing the browser window and not loading the booking engine again.

Search and booking: What you enter in the booking engine, for example the names of the travellers, contact and payment details, is received by travianet and the respective tour operator or airline. They process this data under their own responsibility in order to arrange and carry out your booking. travianet pays us a commission for the arrangement. From travianet we only receive the information needed for their billing (such as booking date, travel price and booking status), but no contact or payment details of the travellers. Details can be found in travianet’s privacy policy for bookings (in German).

Car hire: For car hire, after you click “Show offers” we load, in the same way, the booking engine of Sunny Cars GmbH, which travianet provides. In doing so, your IP address and information about your browser and device are transferred to travianet and to Sunny Cars. You complete your search and booking on the Sunny Cars website, which opens in a new window. The Sunny Cars privacy policy applies there. Here too, the legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

Links to texts of our partner: We link to travianet’s travel conditions, booking information and other mandatory texts. If you click one of these links, you reach their pages via a redirect service of travianet; in doing so, your IP address and technical information about your browser are transferred to travianet.

7. No cookies, local storage in the browser

We use no cookies and no tracking or analytics services. Some features store small entries locally in your browser (local storage or session storage):

• Day or night view (entry “f123-thema”): the view you have chosen, so that it is kept on your next visit.
• Saved destinations (entry “f123-merkliste”): the destinations you have marked with the heart.
• Checklists in the travel guide (entries “f123-liste-…”): which items you have ticked.
• Travel search (entry “f123-reiseshop-ok”, session storage only): that you have agreed to the booking engine being loaded (section 6). It is deleted when you close the browser window.

These entries are not transferred to us or to third parties. Storing them is necessary to provide the features you have expressly requested and is therefore permitted without consent (§ 25(2) no. 2 TDDDG); insofar as personal data is processed, the legal basis is Art. 6(1)(f) GDPR. You can delete the entries at any time via your browser settings.

Should we later use cookies, analytics or marketing services or further embedded third-party content, we will update this privacy policy beforehand and, where required, obtain your consent.

8. Fonts

The fonts used on our website are stored locally on our server and loaded from there. No connection to third-party servers (such as Google Fonts) is made.

9. Storage period

We store personal data only for as long as is necessary for the respective purpose or as statutory retention obligations require. In particular:

• Server log files: at the latest after twelve weeks (section 3).
• Checksums for limiting requests: after ten minutes (section 5).
• Enquiries by email or phone: once fully dealt with, unless a retention obligation applies.
• Commercial and business letters (for example correspondence about a contract): 6 years (§ 147(1) nos. 2, 3, (3) AO; § 257(1) nos. 2, 3, (4) HGB).
• Invoices and accounting records: 8 years (§ 147(1) no. 4, (3) AO; § 257(1) no. 4, (4) HGB; § 14b(1) UStG).
• The statutory retention periods each begin at the end of the calendar year in which the document was created.

10. Recipients and transfers to third countries

Your data is only received by the parties named in this policy:

• the data centre operator of our hosting provider cheaptophost.com (based in the United Kingdom) as a processor for the website and email mailboxes (section 3),
• the service providers of our telephony platform as processors, some of them based in the USA (section 4),
• travianet GmbH, Sunny Cars GmbH and tour operators, airlines and rental companies under their own responsibility, if you load a booking engine or book there (section 6),
• authorities (for example the tax authorities), insofar as we are legally obliged to do so.

The flight data service Duffel (section 5) only receives search terms from us, no information about you. Personal data is only transferred to countries outside the EU or the EEA as described in section 3 (United Kingdom) and section 4 (USA, phone).

11. Your rights

Under the GDPR you have the following rights:

• access to the data stored about you (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR), unless statutory retention obligations prevent this,
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• withdrawal of consent with effect for the future (Art. 7(3) GDPR), insofar as we process data on the basis of consent.

Right to object (Art. 21 GDPR): Where we process data on the basis of Art. 6(1)(f) GDPR (legitimate interest), you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

An informal message to info@flug-123.de is sufficient to exercise your rights. For data you have entered in the booking engine, please contact travianet (section 6).

12. Right to lodge a complaint with the supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. The authority responsible for us is:

13. Obligation to provide data, no automated decision-making

You are not obliged to provide us with any data. Without your details, however, we cannot answer enquiries. Automated decision-making, including profiling within the meaning of Art. 22 GDPR, does not take place.

14. Changes to this privacy policy

We update this privacy policy when our website, our services or the legal situation change. The version published on this page applies.