Privacy Policy

Last updated: October 2026. This is an English translation of our German privacy policy (Datenschutzerklärung), provided for your convenience. The German version shall prevail. Here you can find out which personal data we process when you use our website, send us an inquiry or make a booking.

1. Controller

Akash Nagpal & Nikhil Dingra GbR (“Sightseeing Avenue”)
Partners: Akash Nagpal, Nikhil Dingra
Eiffestraße 600, 20537 Hamburg, Germany
Phone: +49 40 5481 0384 · Email: info@sightseeing-avenue.de

We have not appointed a data protection officer because we are not legally required to do so. If you have any questions about data protection, simply write to us at the address above.

2. Visiting the website and hosting

The website, our customer management system and the database run on our own server, rented from netcup GmbH(Daimlerstraße 25, 76185 Karlsruhe, Germany). The server is located in a data center in Nuremberg; all data stays in Germany. netcup only provides the server and network and processes the data on our behalf (Art. 28 GDPR). When you visit the website, the server processes technically necessary data: IP address, date and time, page requested, browser and operating system, and the previously visited page. This is required to deliver the website and protect it against misuse (Art. 6(1)(f) GDPR). The logs are deleted automatically after a short time.

Fonts and images are hosted on our own server. We only use statistics (Google Analytics) if you consent in the cookie banner (see nos. 3 and 9). We do not use advertising tools or advertising cookies.

3. Cookies and browser storage

We use technically necessary cookies and storage so that the cart, inquiries and payment work (Section 25(2) no. 2 TDDDG, Art. 6(1)(b) and (f) GDPR). Statistics cookies (Google Analytics) are only set if you consent in the cookie banner (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). You can change or withdraw your choice at any time via the “Cookie settings” link at the bottom of every page. For the Regiondo booking calendar on individual tour pages, see no. 7.

Necessary (always active):

  • sa_einwilligung – stores your choice in the cookie banner (whether statistics are allowed and when you chose). Valid for 12 months.
  • sa_anfragen – counts how many inquiries you have sent in this browser session (spam protection, just a number). Valid until you close your browser.
  • sa_warenkorb – remembers your cart in the booking widget across all pages (a random identifier, no personal details). Valid for 24 hours.
  • Entries in the booking form – are kept only in the storage of this browser tab (sessionStorage) so that nothing is lost when you go back, and are deleted when you close the tab.
  • sa_berater – counts how many plans you have created in the Hamburg trip planner (at most 3, just a number). Valid for 30 days.
  • Trip planner hidden – if you click “Not now” on the trip planner button, this browser tab remembers it (sessionStorage) until you close it.
  • Stripe sets its own cookies during payment to prevent fraud (see no. 6).

Statistics (only with your consent):

  • _ga and _ga_QWFQ5227FQ – Google Analytics cookies used to distinguish returning visits (a random identifier). Valid for up to 2 years; we delete them if you withdraw your consent (see no. 9).

4. Inquiry form, “Become a partner” and contact by email or phone

When you send us an inquiry, we process your details (name, email, phone, company if applicable, preferred date, number of people, message) in order to answer your inquiry and make you an offer (Art. 6(1)(b) GDPR, otherwise (f)). We store the data in our customer management system on our own server in Germany (see no. 2).

To protect against spam, we limit the number of inquiries per browser session (cookie sa_anfragen) and per internet address and day. We do not store the IP address itself, only a checksum calculated from it, which is deleted after two days at the latest (Art. 6(1)(f) GDPR – legitimate interest in preventing abuse).

We send and receive emails via IONOS SE (Montabaur, Germany) as our processor.

5. Booking and invoice

For a booking – via the booking widget, via an offer or by phone – we process your contact details, billing address (for companies also company name, VAT ID, order number and, if applicable, Leitweg-ID), the services and dates booked, and the payment data (Art. 6(1)(b) GDPR). We keep invoices and booking records for as long as the law requires (Art. 6(1)(c) GDPR, Section 147 AO, Section 257 HGB – up to 10 years).

Your tickets (vouchers) carry a QR code with a random identifier. At check-in, our guides or the staff of the operating partner see your name, number of people and payment status – no email addresses. Before the tour, our guides receive a list of participants with name, number of people and phone number so that they can reach you in case of delays or changes (Art. 6(1)(b) GDPR).

We send offers and invoices by email with a personal link to view them online. If you open this link, we store the time of the first and last access so that we know whether your offer has arrived (Art. 6(1)(f) GDPR). We do not use tracking pixels in emails.

If a tour is operated by a partner (e.g. a shipping company), we pass on the details required to carry it out (date, number of people, name if applicable) to that partner.

On the day after your tour we send you a single email asking you to review us on Google. For this we use the email address from your booking (Section 7(3) UWG, Art. 6(1)(f) GDPR – our legitimate interest is improving our services and receiving feedback). You can object to this at any time without incurring any costs other than the transmission costs at basic rates – a short reply to the email or a message to us is enough. You leave the review itself voluntarily on Google; Google’s privacy notice applies there.

6. Online payment with Stripe

Online payments are processed by Stripe Payments Europe, Ltd. (Dublin, Ireland). When paying – directly in the booking widget or on Stripe’s payment page – you enter your payment details (e.g. card number) directly with Stripe; we do not receive them, only the payment confirmation, the amount and a reference. We transmit your email address, the amount and the booking number to Stripe (Art. 6(1)(b) GDPR). Stripe also processes data under its own responsibility to prevent fraud and to fulfill its own legal obligations; data may be transferred to Stripe, Inc. (USA), which is certified under the EU-US Data Privacy Framework. More at stripe.com/privacy.

7. Regiondo booking widget on individual pages

Some tours are booked via a partner’s booking system provided by Regiondo GmbH (Munich). The Regiondo booking calendar is embedded directly on these pages so that you can see dates and available spots and book. Your IP address and technical data are transmitted to Regiondo, and Regiondo may set cookies required for the booking. The legal basis is providing the booking service you request (Section 25(2) no. 2 TDDDG, Art. 6(1)(b) and (f) GDPR; our legitimate interest is simple online booking). If you prefer not to use it, you can book by phone or via the inquiry form. If you book via Regiondo, the respective provider is responsible for the booking and its privacy notices apply (Art. 6(1)(b) GDPR).

8. Hamburg trip planner (AI)

When you use the Hamburg trip planner, we send your answers (travel dates, number of people, interests and your optional note) together with our tours and available dates to Anthropic, PBC (San Francisco, USA). Its AI model Claude creates your plan and, where useful, searches the internet for public events. We do not ask for your name, email address or other contact details; please do not enter them in the note either. We do not pass your IP address on to Anthropic. Anthropic processes the data on our behalf (Art. 28 GDPR) and not to train its own models; the transfer to the USA is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). The legal basis is providing the service you request (Art. 6(1)(b) GDPR). We do not store the plan itself. To prevent excessive use, a cookie remembers how many plans you have created (30 days), and we count per IP address and day using an encrypted identifier that is deleted after two days (Section 25(2) no. 2 TDDDG, Art. 6(1)(f) GDPR; our legitimate interest is protection against misuse).

9. Statistics with Google Analytics (only with consent)

If you choose “Accept all” in the cookie banner or switch on “Statistics”, we use Google Analytics 4, a service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Google Analytics shows us which pages are visited and how often, roughly where visitors come from (country, city) and which device they use – so we can see what is in demand and improve the website. For this purpose, cookies are set (see no. 3) and usage data such as pages visited, time spent, device, browser and your IP address are transmitted to Google. Google Analytics 4 does not store full IP addresses; the approximate location is determined within the EU. We have turned off Google signals and personalized advertising, and we do not combine the data with other data about you.

The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). Without your consent, Google Analytics is not loaded. You can withdraw your consent at any time via “Cookie settings” at the bottom of every page; we then delete the Analytics cookies in your browser and no further data is transmitted. Google processes the data on our behalf (Art. 28 GDPR). Data may be transferred to Google LLC (USA); Google is certified under the EU-US Data Privacy Framework, and the EU Standard Contractual Clauses also apply. Data in Google Analytics is deleted after 14 months at the latest. More at policies.google.com/privacy.

10. Links to Instagram and Google

On our website we link to our Instagram profile (Meta Platforms Ireland Limited) and to our Google listing (Google Ireland Limited). These are simple links: nothing is loaded from Instagram or Google when you visit our website. Only when you click such a link do you leave our website; the privacy policy of the respective provider then applies.

11. How long we store data

  • Inquiries without a booking: until the inquiry has been dealt with, then for no longer than 3 years (limitation period for possible claims).
  • Bookings, invoices, payments: in accordance with the statutory retention periods (up to 10 years).
  • Incomplete payments in the booking widget: the booking remains stored as “canceled” and is deleted together with the inquiries.
  • Cart without booking: the reservation expires after 20 minutes.
  • Hamburg trip planner: the plan is not stored; the counter cookie lasts 30 days, the counter per IP address 2 days.
  • Google Analytics: no longer than 14 months; cookies up to 2 years or until you withdraw your consent.

12. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw any consent (e.g. for Google Analytics) at any time with effect for the future (Art. 7(3) GDPR). Right to object: where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation (Art. 21 GDPR). A message to info@sightseeing-avenue.de is sufficient.

You can also lodge a complaint with a data protection supervisory authority, for example the Hamburg Commissioner for Data Protection and Freedom of Information (Hamburgischer Beauftragter für Datenschutz und Informationsfreiheit), Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany.

13. No automated decision-making

We do not make decisions based solely on automated processing (Art. 22 GDPR) and do not create profiles.