1Who is responsible for your data
The controller for the personal data processed through this website, within the meaning of the General Data Protection Regulation (GDPR), is:
Fener Travel & Tourism, Südring 36, 44787 Bochum, Germany. Represented by Fener Rasoul. Telephone +49 176 32200512. Email info@fenertravel.de.
If you have a question about how your data is handled, write to that address and say what you would like to know. You do not need to use a particular form of words.
2What this policy covers
This policy describes what happens to personal data on this website — what is collected, why, on what legal basis, who else sees it and how long it is kept.
It does not cover what happens after you become a customer and we handle a booking, a shipment or a visa file for you. That work involves passing your details to an airline, a carrier or an authority, and it is governed by the agreement and the power of attorney you sign with us.
Personal data means any information that relates to you as an identifiable person: your name, your email address, your telephone number, your IP address.
3Hosting and server logs
This website is hosted by Hostinger International Ltd. on servers in the European Union. Hostinger acts as our processor and handles data only on our instructions.
Like every web server, ours records each request: the IP address it came from, the date and time, the page requested, the referring page, and the browser and operating system reported by your device. This happens automatically and is not linked to any other data about you.
The legal basis is our legitimate interest in operating the site securely and diagnosing faults (Art. 6(1)(f) GDPR). These logs are kept for a short period and then deleted.
4The contact form
The form asks for your name, your email address and your message. A telephone number is optional. Nothing else about you is collected by the form, and there are no hidden fields that record anything further.
When you send it, two emails are generated: a notification to our office so we can answer you, and a confirmation to you so you have a copy of what you sent. Both are delivered through Brevo, our email provider — see the next section.
The legal basis is Art. 6(1)(b) GDPR where your message concerns a booking or a service you are asking us to provide, and Art. 6(1)(f) GDPR — our legitimate interest in answering enquiries — for anything else.
To stop automated abuse, the form is rate-limited by IP address and carries a hidden field that a person never fills in but a script often does. Neither is used to profile you.
Giving us this data is voluntary, but we cannot answer an enquiry without a name, an email address and a message.
5Email delivery and our contact list (Brevo)
We use Brevo (Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France) to send the emails this site generates. Brevo is established in the European Union and acts as our processor.
Your name, email address and — if you gave one — your telephone number are also stored in our Brevo contact list, so that the office has a record of who has been in touch beyond a single email. The message itself is not stored there; it stays in the notification email.
The legal basis is our legitimate interest in keeping an orderly record of enquiries (Art. 6(1)(f) GDPR). You can ask us to remove you from that list at any time, and we will.
This site does not run a newsletter. Being on the contact list does not mean you will receive marketing email from us.
6Cookies and your consent
The site itself sets no tracking cookies. It stores one thing in your browser on its own account: whether you chose the light or the dark colour theme. That stays on your device, is never sent to us, and identifies nobody.
Anything that does require consent — analytics — is held back by a consent banner until you accept it. The banner is provided by Cookiebot, a service of Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark, which records your consent choice so we can show it was given. Declining costs you no functionality: every page, price and form works exactly the same either way.
The legal basis for non-essential cookies is your consent, under Art. 6(1)(a) GDPR and § 25(1) TTDSG. You can change or withdraw that decision at any time through the banner, and withdrawal does not affect anything done before you withdrew.
7Google Analytics
If — and only if — you accept the analytics category in the consent banner, this site loads Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
It tells us which pages are read and roughly where visitors come from, so we know which services to write about. IP addresses are shortened by Google before storage, and we do not use Analytics to build advertising audiences.
Google may transfer data to the United States. Google LLC is certified under the EU–US Data Privacy Framework, which the European Commission has recognised as providing an adequate level of protection.
The legal basis is your consent (Art. 6(1)(a) GDPR). Until you give it, the Analytics script is present on the page but blocked, and it sends nothing.
8Google Maps
The contact page can show a map of our office, embedded from Google Maps. Loading it means your IP address, and information about your browser, reach Google Ireland Limited.
Links elsewhere on the site that open directions in Google Maps only do so when you click them. Nothing is sent to Google by the link merely being on the page.
The legal basis is your consent where the map is loaded through the consent banner, and otherwise our legitimate interest in helping you find the office (Art. 6(1)(f) GDPR). Google’s own privacy policy governs what it does with the data.
9Fonts, and what this site deliberately does not load
The typefaces are served from our own server, not from Google Fonts. A German court found that embedding Google Fonts transmits the visitor’s IP address to Google without a legal basis; hosting the files ourselves removes that request entirely, so there is nothing to consent to and nothing to block.
There are no advertising pixels, no social media tracking widgets and no embedded video players on this site. Our social media profiles are reached by ordinary links, which send nothing until you click them.
10How long we keep things
Enquiries are kept for as long as it takes to deal with them and for a reasonable period afterwards, in case you come back to the same matter.
Where a message becomes part of a commercial transaction, German commercial and tax law requires us to retain the correspondence — six years under § 257 HGB and up to ten years under § 147 AO. During that period the data is restricted: it is kept because the law requires it, not used for anything else.
Everything else is deleted once the purpose it was collected for has ended, or when you ask us to delete it and no retention duty applies.
11Your rights
You have the right to ask what data we hold about you and to receive a copy of it (Art. 15 GDPR); to have inaccurate data corrected (Art. 16); to have data erased (Art. 17); to have its processing restricted (Art. 18); and to receive it in a portable, machine-readable form (Art. 20).
You have the right to object at any time to processing we base on legitimate interests (Art. 21 GDPR). Where processing rests on your consent, you may withdraw it at any time, and doing so does not make what was done beforehand unlawful.
Exercising any of these is free, and you do not have to give a reason. Write to info@fenertravel.de or to the postal address above. We will answer within one month; if the request is complex we may extend that and will tell you why.
12Complaining to a supervisory authority
If you believe we are handling your data unlawfully, you may complain to a data protection supervisory authority — in the state where you live, where you work, or where the alleged infringement took place (Art. 77 GDPR).
The authority responsible for us is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.
You are welcome to raise the matter with us first. You are not obliged to.
13Changes to this policy
This policy is updated when the site changes — when a service is added, or a provider is replaced. The version published here is the one that applies.
It does not change retrospectively: data already collected stays governed by the terms it was collected under, unless you agree otherwise.