Privacy Policy

Last updated: October 2026

1. Data Controller

The controller responsible for processing personal data on this website is:

Travaholica Owner: Mahmoud Shaaban Abdelghany Abdelrahman Onkel-Tom-Straße 110 14169 Berlin, Germany

Email: info@travaholica.com Telephone: +49 179 6660678

2. General Information on Data Processing

We process personal data only where necessary to operate our website, respond to inquiries, manage interest registrations, arrange travel bookings, provide travel services, process payments where available, and comply with legal obligations.

Personal data is processed in accordance with the General Data Protection Regulation (GDPR) and applicable German data protection laws.

Depending on the purpose, processing may be based on:

Article 6(1)(a) GDPR: Consent, where required.
Article 6(1)(b) GDPR: Performance of a contract or steps taken before entering into a contract at your request.
Article 6(1)(c) GDPR: Compliance with legal obligations.
Article 6(1)(f) GDPR: Legitimate interests, particularly website security, abuse prevention, and efficient communication.

Where we rely on legitimate interests, we consider the rights and interests of the individuals concerned.

3. Website Hosting – Vercel

Our website is hosted using services provided by Vercel Inc.

When you visit our website, technical information may be processed, including your IP address, date and time of access, requested pages, browser and device information, and server log data.

This processing supports the secure and reliable operation of our website and is generally based on Article 6(1)(f) GDPR.

Vercel is a U.S.-based service provider. Personal data may be processed outside the European Union or European Economic Area. Where required, international data transfers are subject to appropriate safeguards under the GDPR.

4. Contact Forms, Booking Inquiries and Interest Registrations

When you contact us or submit an inquiry or interest registration, we process the information you provide.

Depending on the form, this may include:

Name and email address.
Telephone number, where requested.
Travel preferences and inquiry details.
Number of travelers and room preferences.
Optional dietary or accessibility information.
Messages and other information voluntarily submitted.
Marketing preferences and consent records.
Submission timestamps and related technical information.

We use this information to respond to inquiries, communicate with prospective travelers, prepare bookings, and provide requested travel services.

Processing for contractual or pre-contractual purposes is generally based on Article 6(1)(b) GDPR. Other processing may rely on consent or legitimate interests, depending on its purpose.

Data Storage – Supabase

We use Supabase to store and manage website inquiries and interest registrations. Our database is hosted in the EU (Frankfurt region).

Stored information may include submitted form details, consent status and timestamps, the applicable privacy policy version, submission timestamps, and email delivery status.

For security and abuse prevention, IP addresses, submission endpoints, and timestamps may also be stored for request rate limiting.

Email Communications – Brevo

We use Brevo to send transactional emails, including inquiry confirmations, registration acknowledgments, and internal notifications to Travaholica.

Brevo processes the email addresses and message content necessary to deliver these communications. Internal notifications may also contain registration details, marketing preferences, and campaign attribution information.

Transactional emails are used to respond to inquiries and manage requested services. Marketing emails, if introduced, will be handled separately and sent only where a valid legal basis exists.

5. Payment Processing

Online payment functionality is currently not enabled on this website.

If online payments are introduced, this section will be updated before activation to identify the payment service provider, explain the categories of personal data processed, describe the purposes and legal bases of processing, and provide information about relevant international data transfers.

6. Cookies, Session Storage and Tracking Technologies

We currently do not use Google Analytics or other third-party advertising or analytics tracking tools on this website.

Our website may use technically necessary storage or similar technologies to support its operation, security, and services requested by visitors.

Where available, campaign attribution information, including UTM source, medium, campaign, and referring-page information, may be stored temporarily in your browser's sessionStorage and submitted together with an inquiry or interest registration.

This information helps us understand how visitors discover our services and which inquiries relate to particular campaigns.

If we introduce analytics, advertising technologies, or other services requiring consent, we will update this Privacy Policy and obtain consent where legally required.

7. Travel Service Providers and International Data Transfers

When necessary to arrange or perform a booked journey, we may share relevant personal information with service providers involved in delivering travel services.

These may include:

Hotels and accommodation providers.
Airlines and transportation providers.
Local travel agencies and ground handlers.
Tour guides and activity providers.
Other providers necessary to perform the travel contract.

We share only the information reasonably necessary for the relevant service.

Some providers may be located outside the European Union or European Economic Area, particularly in Egypt.

Where personal data must be transferred to such providers, we assess the applicable requirements under Chapter V GDPR. Where appropriate, transfers necessary for the performance of a travel contract may rely on Article 49(1)(b) GDPR; other transfers require a suitable legal transfer mechanism.

8. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected or where retention is required by law.

This includes information relating to inquiries, interest registrations, travel bookings, payment records, and customer communications.

Relevant documents may be retained for the periods required under applicable German tax and commercial laws.

Retention periods for inquiry records, interest registrations, security logs, and email delivery records will be determined according to their respective purposes and applicable legal requirements.

Where personal data is no longer required and no legal retention obligation applies, it will be deleted or anonymized.

9. Disclosure of Personal Data

We do not sell personal data.

Personal information may be disclosed to service providers where necessary to operate our website, process inquiries, deliver communications, arrange travel services, process payments where available, or comply with legal obligations.

Service providers processing personal data on our behalf are subject to applicable contractual and data protection requirements.

10. Your Rights

Under the GDPR, you may have the right to:

Request access to your personal data.
Request correction of inaccurate or incomplete information.
Request deletion of personal data.
Request restriction of processing.
Receive certain personal data in a portable format.
Object to processing based on legitimate interests.
Withdraw consent at any time where processing is based on consent.

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

You also have the right to object to the processing of your personal data for direct marketing purposes at any time.

To exercise your rights, please contact us at info@travaholica.com.

11. Right to Lodge a Complaint

You have the right to lodge a complaint with a competent data protection supervisory authority if you believe that your personal data has been processed in violation of applicable data protection law.

For our business in Berlin, the competent supervisory authority is generally:

Berliner Beauftragte für Datenschutz und Informationsfreiheit

Website: https://www.datenschutz-berlin.de

12. Changes to This Privacy Policy

We may update this Privacy Policy when necessary to reflect changes to our website, services, technology providers, or legal obligations.

The current version will be published on this website.

Last updated: October 2026