Privacy Policy
Last updated: 16 October 2026
1. Data Controller
The controller responsible for the processing of personal data on this website is:
Nostalgic GmbH & Co. KG
Balanstraße 73
81541 Munich
Germany
Phone: +49 (0)89 5454060
Email: info@nostalgic.de
This Privacy Policy explains how we process personal data when you visit our website, contact us, subscribe to our newsletter, make an online booking, or use services integrated into our website.
2. Cookie Consent Management
Complianz Software is used for Cookie Consent Management; it prevents all non-essential analytics and marketing technologies from loading before consent.
3. General Information on Data Processing
We process personal data only to the extent necessary to provide our website and services, where you voluntarily provide such data to us, where processing is necessary in connection with pre-contractual measures or the performance of a contract, where we are subject to a legal obligation, or where you have given your consent.
Depending on the specific processing activity, the relevant legal bases include in particular:
Art. 6(1)(a) GDPR – consent
Art. 6(1)(b) GDPR – pre-contractual measures and performance of a contract
Art. 6(1)(c) GDPR – compliance with legal obligations
Art. 6(1)(f) GDPR – legitimate interests
Where information is stored on or accessed from your terminal device, this is additionally carried out in accordance with Section 25 TDDDG (German Telecommunications Digital Services Data Protection Act).
4. Hosting and Server Log Files
Our website is hosted by Hostinger on a server located in Düsseldorf, Germany. webgo provides DNS hosting for our domain, and InterNetX is the domain registrar. Let's Encrypt provides TLS certificates. The web server maintains access logs including visitors' IP addresses for security and technical operation. These logs are automatically deleted after seven days. Processing is based on Art. 6(1)(f) GDPR, our legitimate interest in secure and reliable website operation. Connections to the website are encrypted using TLS/HTTPS.
5. Language Detection
When you open our website, our server checks which country your IP address is assigned to, so that we can offer you the appropriate language version of the site. For this the IP address is passed to the service ipapi.co (ipapi, United States). Only the result, the country code, is stored on our server, for 24 hours. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in presenting the website in a suitable language.
6. Cookies and Similar Technologies
We use Complianz as our consent management platform. Complianz asks visitors for consent before non-essential technologies are activated. Essential cookies and technologies may be used where necessary to provide a service requested by the visitor, pursuant to Section 25(2) TDDDG. For non-essential storage or access to information on a device, the legal basis is Section 25(1) TDDDG; associated personal-data processing is based on Art. 6(1)(a) GDPR. Consent can be changed or withdrawn at any time through the Cookie Settings on our website. The categories, purposes, providers and lifetimes of individual cookies are shown in the Complianz cookie information. Consent withdrawal does not affect earlier lawful processing.
7. Contact and Contact Forms
If you contact us by email, telephone or through a form, we process your name, contact details, message and any information you choose to provide to respond to your enquiry. Callback and brochure request forms are operated using Gravity Forms. Submitted data are stored in our website database on the German hosting server. Notification emails are sent using our Microsoft 365 email account. Depending on the enquiry, the legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in responding).
8. Online Tour Bookings
Our website allows binding tour bookings through a custom booking plugin. We process booking and contact information, the tour selected, information about accompanying travellers, arrival and departure details and any voluntary requests needed to organise the tour. Submitted data are stored in the website's own database on our server in Germany. No external booking platform or CRM is connected. Notification emails are sent through Microsoft 365. No payment is processed on the website; booking confirmations and payment information are provided separately. The legal basis is Art. 6(1)(b) GDPR. To deliver the booked tour, relevant details may be shared with hotels, transport providers, restaurants, guides and other travel service providers. We do not request medical information through dedicated fields. Please avoid including health or other sensitive personal information in free-text fields. If special dietary or health-related arrangements are required, please contact us separately so we can determine an appropriate lawful process.
9. Personal Data of Accompanying Travellers
If you make a booking for additional travellers and provide us with their personal data, we process these data for the preparation and performance of the booked tour.
Please ensure that you are entitled to provide us with the relevant information and that the persons concerned are informed about the processing of their personal data by Nostalgic.
10. Newsletter
Newsletter registrations are collected through Elementor Forms and stored in the website database on our German server. We use Mailchimp (The Rocket Science Group LLC / Intuit) to distribute newsletters. Where registration data are transferred to Mailchimp, they are processed for newsletter delivery and, where enabled, newsletter engagement reporting. The legal basis for newsletter subscriptions is Art. 6(1)(a) GDPR. You can unsubscribe at any time using the link in each newsletter. Processing by Mailchimp may involve transfers to the United States subject to the applicable GDPR transfer mechanism.
11. Analytics and Advertising
We do not currently use Google Analytics, Google Ads, Hotjar or any other analytics, statistics or advertising service on this website, and no such tracking is installed. Should we introduce one in future, this Privacy Policy will be updated and, where required, your consent obtained beforehand.
12. Social Media and External Content
Our website provides only ordinary external links to social media platforms such as Facebook, Instagram and Pinterest. We do not use Meta Pixel, Meta Conversions API, embedded Instagram feeds, social media plugins or other social media tracking technologies. Simply displaying these links does not transfer visitor data to the respective platforms. If you follow a link, the privacy practices of the destination platform apply.
Vimeo Video Content
We use Vimeo to display background videos on our homepage, tour pages and events page. Vimeo content may connect to Vimeo servers and transmit technical information, including the visitor’s IP address, and may access information on the visitor’s device. The loading of Vimeo content and any required consent are managed through Complianz. Vimeo videos are loaded automatically when the applicable consent has been obtained; without the required consent, Vimeo content is blocked. The legal basis for consent-dependent processing is Art. 6(1)(a) GDPR and, where applicable, Section 25(1) TDDDG. Consent may be changed or withdrawn through Cookie Settings. Vimeo may process data outside the EEA under applicable safeguards. Further information is available in Vimeo’s privacy policy.
YouTube Video Content
A video provided by YouTube (Google Ireland Limited) is shown in the footer of our website. Like the Vimeo content, it is loaded only after you have given your consent. The legal basis is Art. 6(1)(a) GDPR and, where applicable, Section 25(1) TDDDG.
13. Contact Button
Our website shows a floating contact button offering our telephone number and WhatsApp. No data is sent to WhatsApp or Meta unless you click the WhatsApp button. If you do, you leave our website and WhatsApp’s own privacy terms apply. The button itself records only how often it was shown and how often it was clicked, as daily totals in our own database. No personal data is stored for this purpose.
14. Locally Hosted Fonts
The fonts used on our website are hosted locally on our own server. Visiting the website does not require loading Google Fonts from Google servers.
15. Programme Libraries
Two functions on our website, the tour filter and the testimonial gallery, use freely available programme libraries which are loaded from the delivery network jsDelivr. When a page using these functions is opened, your IP address is transmitted to that network so that the files can be delivered. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in the secure and efficient delivery of our website.
16. Recipients and Processors
Service providers involved in the operation of our website and communications include Hostinger (website hosting in Germany), webgo (DNS hosting), InterNetX (domain registrar), Let's Encrypt (TLS certificates), Microsoft 365 (email), Complianz (cookie consent management), Gravity Forms, Elementor Forms, our custom booking plugin and Mailchimp (newsletter delivery). Where these parties act as processors, we use data processing agreements as required by Art. 28 GDPR. For travel bookings, information necessary for performance may be shared with hotels, transport providers, restaurants, guides and other suppliers. No external booking service or CRM is currently connected.
17. Transfers to Third Countries
Our website and form database are hosted in Germany. Use of Microsoft 365, Mailchimp, Vimeo and international travel suppliers may involve processing or transfers outside the EEA. Such transfers must have an applicable legal basis and, where required, an adequacy decision, appropriate safeguards such as EU Standard Contractual Clauses, or a permitted derogation for contract performance.
18. Data Retention
Server access logs containing IP addresses are automatically deleted after seven days. Booking, enquiry and newsletter data are retained only for the relevant purposes and any applicable statutory retention periods. Records required under commercial or tax law may need to be retained longer; data needed to establish or defend legal claims may also be retained as permitted by law.
19. Your Rights
Subject to the applicable legal requirements, you have in particular the following rights:
- right of access to your personal data
- right to rectification of inaccurate data
- right to erasure
- right to restriction of processing
- right to data portability
- right to object to certain processing
- right to withdraw consent with effect for the future
Where processing is based on Art. 6(1)(f) GDPR, you may object to such processing on grounds relating to your particular situation.
You may object at any time to the processing of your personal data for direct marketing purposes.
To exercise your rights, please contact:
Nostalgic GmbH & Co. KG
Balanstraße 73
81541 Munich
Germany
Email: info@nostalgic.de
20. Right to Lodge a Complaint
You have the right to lodge a complaint with a competent data protection supervisory authority regarding the processing of your personal data.
The supervisory authority responsible for Nostalgic is in particular:
Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18
91522 Ansbach
Germany
21. Data Security
We take appropriate technical and organisational measures to protect personal data against loss, manipulation, unauthorised access and other unlawful processing.
Our security measures are regularly reviewed and adapted in accordance with technological developments and the respective risks.
22. Changes to this Privacy Policy
We may amend this Privacy Policy if legal requirements, the services we use or our processes change. The current version is published on this website.
