Privacy Policy
Version dated 26 November 2025
This Privacy Policy informs you about the scope of the processing of your personal data (hereinafter referred to as “data”).
1. Controller responsible for data processing
The controller responsible for data processing in accordance with the provisions of the General Data Protection Regulation (GDPR) is:
STR Destination Handling GmbH & Co. KG
Industriestraße 38a
D-63150 Heusenstamm, Germany
Tel.: +49 6104 780480
Website: https://www.str-destination.de
Email:
2. Contact details of our Data Protection Officer
Matthias Rosa, email:
3. General information on data processing
We process data as part of our business and website operations.
This also includes disclosure through transmission to third parties and, where applicable, to so-called third countries outside the European Union (“EU”) and the European Economic Area (“EEA”). Where we transfer data outside the EU or EEA, we have indicated this accordingly below.
4. Data processing
The specific data concerned, processing purposes, legal bases, recipients and, where applicable, transfers to third countries are set out below:
a) Log file when visiting the website
We log your visit to our website. In doing so, we process:
- the name(s) of our website page(s) accessed,
- the date and time of access,
- the volume of data transferred,
- the browser type and version,
- the operating system you use,
- the referrer URL (the website visited previously),
- your IP address,
- the requesting provider.
The legal basis for the processing is our overriding legitimate interest in the continuous availability and security of our website pursuant to Article 6(1)(f) GDPR.
The log file is deleted after seven days unless it is required to demonstrate or investigate specific legal infringements that became known during the retention period.
b) Hosting
To provide our online presence, we use services supplied by web-hosting providers. These providers process on our behalf the data referred to above and all data processed in connection with the operation of this website (log file when visiting the website).
The legal basis for the processing is our overriding legitimate interest in providing our website pursuant to Article 6(1)(f) GDPR.
c) Contacting us
If you contact us, we process your name, contact details, where provided, and your message for the purpose of handling and completing your enquiry.
The legal basis for the processing is our obligation to perform a contract and/or take steps prior to entering into a contract pursuant to Article 6(1)(b) GDPR and/or our overriding legitimate interest in handling your enquiry pursuant to Article 6(1)(f) GDPR.
d) Contact in connection with applications
If you contact us to submit an application for employment, for example by email or via a contact form, the data you provide (such as your name, email address and preferred place of work), your message and the application documents submitted will be processed solely for the purpose of handling and completing your application enquiry.
The primary legal basis for the processing is Article 6(1)(b) GDPR. The data is processed in connection with the decision on establishing an employment relationship.
If, following completion of the application process, the data may be required for legal proceedings, processing may take place to safeguard our legitimate interests pursuant to Article 6(1)(f) GDPR, namely for the establishment and/or defence of legal claims.
e) Contract processing
We process your data for the purpose of administering the contractual relationship between you and us.
The legal basis for the processing is the performance of our contractual obligations pursuant to Article 6(1)(b) GDPR and, in individual cases, compliance with our legal obligations pursuant to Article 6(1)(c) GDPR.
We transmit your address details and other data required to carry out a trip to the company commissioned to provide the travel service (airlines, hotels, etc.).
If necessary to carry out the trip, we also collect information on required vaccination status and/or intolerances.
We transmit your transaction data (name, booking date, payment method, dispatch and/or receipt date, amount and payment recipient and, where applicable, bank or credit-card details) to the payment service provider commissioned to process the payment.
f) Newsletter
To provide regular information about our company and offers, we offer a German-language email newsletter to German-speaking tour operators in the DACH market. When you register for the newsletter, we process the data entered during registration (name, company, email address and any other voluntary information). To prevent misuse, after registration we send you an email asking you to confirm your subscription (double opt-in procedure). Your registration is logged so that the registration process can be demonstrated in a legally compliant manner. This includes the time of registration and confirmation and your IP address.
The legal basis for sending the newsletter is your consent pursuant to Article 6(1)(a) GDPR. Processing in connection with sending the confirmation email and the associated logging is carried out pursuant to Article 6(1)(f) GDPR on the basis of our legitimate interest in demonstrating that registration was completed properly.
If you give us your consent, we also analyse whether you have opened the newsletter and your scrolling and clicking behaviour within it. This is done to tailor our newsletter to your interests and improve its content. The legal basis for newsletter analysis is your consent pursuant to Article 6(1)(a) GDPR.
For newsletter distribution, we use a German service provider to which we transmit the data specified above.
g) Direct email advertising to existing customers
Unless you have objected, we send you direct advertising relating to goods and services you have purchased in order to offer you similar goods and services from our portfolio. We use the email address you provided when entering into the contract. You were informed of your right to object when your email address was collected.
You may object to this use of your email address at any time free of charge. Use the unsubscribe link in each advertising email or send an email to
The legal basis for sending direct advertising is Article 6(1)(f) GDPR (legitimate interest in direct marketing to existing customers). For customers in Germany, we also comply with Section 7(3) of the German Act Against Unfair Competition (UWG) in conjunction with Article 95 GDPR.
h) ITB online calendar
To enable you to arrange an appointment directly with an exhibitor at the International Tourism Trade Fair (ITB), we provide an online calendar on our website for a limited period corresponding to the respective duration of the ITB. The appointment you request, together with the contact details you provide, is forwarded to the contact you select. The data is processed on the basis of Article 6(1)(b) GDPR.
i) Loomly
We use the social-media management platform Loomly, provided by Loomly Inc., based in Los Angeles, California, USA. It is used to schedule social-media posts and obtain information about the use of our social-media channels.
A transfer of personal data to the USA cannot be ruled out. For transfers to the USA, Loomly ensures an adequate level of data protection through the EU Standard Contractual Clauses. A copy of the relevant EU Standard Contractual Clauses is available on request. Please contact
The data is processed on the basis of our legitimate interest in providing our social-media presence pursuant to Article 6(1)(f) GDPR.
j) Participation in prize draws
If you participate in a prize draw organised by us, we process the data you provide: first name, surname and email address and, where provided, address, company and telephone number, for participation and for contacting you if you win. If you are selected as a winner, we will request your first name, surname and address for delivery of the prize if this information was not already provided during registration. In all cases, we will first notify you of your win by email.
For delivery of the prize, we will transmit your first name, surname and address to the company commissioned to deliver it.
The data is processed to fulfil our obligations in connection with the prize draw pursuant to Article 6(1)(b) GDPR.
k) Surveys
For participation in our surveys, for example among customers and prospective customers, we use SurveyMonkey, a tool provided by the US company Momentive Inc., 1 Curiosity Way, San Mateo, California 94403, USA. We process your email address to contact you and, in connection with the survey, your age group and any personal data you provide voluntarily for the evaluation of our surveys.
The legal basis for contacting you and conducting the survey is your consent pursuant to Articles 6(1)(a) and 7 GDPR.
When you participate in this survey, your usage data is transferred to Momentive Inc. in the USA, in particular the name(s) of the website page(s) accessed, the date and time of access, the volume of data transferred, browser type and version, operating system used, referrer URL, IP address, requesting provider, and all personal data that you transmit to Momentive Inc. yourself. However, these processes are the responsibility of Momentive Inc. and cannot be influenced by us.
Momentive Inc. is certified under the EU-US Data Privacy Framework and is therefore covered by the EU adequacy decision for the USA.
Further information is available in the Momentive Inc. Privacy Policy.
l) Use of photographs and videos from trade fairs and events
At events held by STR Destination GmbH & Co. KG, photographs and videos are produced to provide visual documentation of the events. We publish these photographs and video recordings (including sound) in follow-up coverage on our intranet and website. We do not produce portraits or direct images of you as a visitor to our trade fairs or events unless you explicitly permit this. The processing is based on our legitimate interests pursuant to Article 6(1)(f) GDPR in documenting and promoting the event concerned.
In all other cases, particularly portraits or direct images, processing takes place solely on the basis of your prior consent pursuant to Article 6(1)(a) GDPR and Section 22 of the German Art Copyright Act (KUG) for publication. We publish the photographs and video recordings in follow-up coverage on our intranet and website. If you wish to consent to such processing, you can place one of the provided stickers visibly on your clothing for the photographer.
m) Cookies
We use cookies on our website. Cookies are small text files stored on your respective device (PC, smartphone, tablet, etc.) by your browser.
Information about the cookies we use, their providers and purposes is available in our Cookie Settings and in the consent banner we use.
There you can grant your consent to the respective services, withdraw it or subsequently change your settings.
Our consent banner
We use a consent banner on our website. This allows us to disclose all cookies used on our website accurately and transparently.
The legal basis for the processing is compliance with our legal obligations pursuant to Article 6(1)(c) GDPR.
n) Analytics / marketing
Google services
We use various services provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter “Google”) on our website. This may also involve transfers of data to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
Google is certified under the EU-US Data Privacy Framework and is therefore covered by the EU adequacy decision for the USA.
Google Analytics 4
We use Google Analytics 4 on our website.
IP addresses are not logged or stored when data is collected in Google Analytics 4.
In Analytics, all IP addresses collected from users in the EU are deleted before the data is recorded through EU domains and servers.
In addition, the following functions can be disabled in Analytics:
- collection of data for Google Signals for individual regions,
- collection of detailed location and device data for individual regions.
Google Analytics 4 does not log or store individual IP addresses.
Analytics does not provide precise location data. Instead, the following metadata is derived from IP addresses: city (and the derived latitude and longitude of the city), continent, country, region and subcontinent, including their ID-based equivalents. For access originating in the EU, IP address data is used only to derive location data and is then deleted immediately. It is not logged, is not accessible and is not used for any other purposes.
When measurement data is collected in Analytics, all IP lookups take place on EU-based servers before traffic is forwarded to Analytics servers for processing.
In Google Analytics 4, all data from devices located in the EU, based on geographic location according to the IP address, is collected through domains and servers in the EU before traffic is forwarded to Analytics servers for processing.
If you currently use a Content Security Policy (CSP), you must update your configuration (img-src and connection-src directives) to permit the following domains used by Analytics:
- *.google-analytics.com
- *.analytics.google.com
Google Ads
We use Google Ads, an online advertising programme provided by Google, on our website. This involves conversion tracking. When you select an advertisement placed by Google, a cookie is set. These cookies expire after 30 days and are not used to identify users personally. If the user visits certain pages of this website while the cookie is still valid, Google and we can recognise that the user selected the advertisement and was redirected to this page.
The data obtained using the conversion cookie is used to compile statistics for Ads customers who have opted for conversion tracking.
Legal basis and withdrawal
The legal basis for processing in connection with the Google services referred to above is your prior consent pursuant to Article 6(1)(a) GDPR.
You can withdraw your consent at any time with effect for the future by adjusting your preferences in our Cookie Settings or by using the settings at Google Ads Preferences.
Please also note Google's information on the use of data in the Google partner network at Google Privacy & Terms.
o) External content
We use dynamic content supplied by third parties to optimise the appearance and offering of our website. When the website is visited, an interface automatically sends a request to the respective content provider's server, in which certain log data, such as the user's IP address, is transmitted. The dynamic content is then transmitted to and displayed on our website.
We use external content in connection with the following functions:
Embedding YouTube videos
We have embedded videos from the YouTube portal provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”) on our website. Google does not store cookies in your browser in this process.
The legal basis for the processing is your prior consent pursuant to Article 6(1)(a) GDPR.
A transfer of data to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA cannot be ruled out.
Google is certified under the EU-US Data Privacy Framework and is therefore covered by the EU adequacy decision for the USA.
reCAPTCHA
We use Google's “Google reCAPTCHA” service on our website to protect it against interactions by bots. When you visit the website, data including your IP address, referrer URL, information about the operating system, information about cookies, mouse movements and keystrokes, time spent on the website and your device settings is transmitted to Google. The legal basis is our legitimate interest in securing our website pursuant to Article 6(1)(f) GDPR.
The controller responsible for the processing is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter “Google”). A transfer of data to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA cannot be ruled out.
Google is certified under the EU-US Data Privacy Framework and is therefore covered by the EU adequacy decision for the USA.
5. Social-media presence
For the purpose of presenting our company and interacting and communicating with interested parties and customers, we operate the following social-media channels:
Our Facebook Privacy Policy is available here: https://www.str-destination.de/datenschutz-facebook-fanpage
Our YouTube Privacy Policy is available here: https://www.str-destination.de/youtube-datenschutzerklaerung
Our Instagram Privacy Policy is available here: https://www.str-destination.de/instagram-datenschutzerklaerung
The legal basis for the processing is our overriding legitimate interest in optimally marketing our online offering and in customer retention and acquisition pursuant to Article 6(1)(f) GDPR.
6. Duration of data storage
We retain personal data only for as long as is necessary for the purposes for which it is processed or until consent you have granted is withdrawn. Where statutory retention obligations apply, the retention period for certain data may be up to ten years irrespective of the processing purposes. For applications, we delete your data no later than four months after completion of the application process.
7. Your rights as a data subject
a) Access
At your request, you will receive information free of charge at any time about all personal data that we have stored about you.
b) Rectification, erasure, restriction of processing and objection
If you no longer agree to the storage of your personal data or if the data has become inaccurate, we will, upon receiving an appropriate instruction, arrange for your data to be erased or blocked or make the necessary corrections, insofar as permitted by applicable law. The same applies if we are to process data only on a restricted basis in the future. You have a right to object in particular where your data is processed in the performance of a task carried out in the public interest or on the basis of our legitimate interests, including profiling based on those grounds. You also have such a right to object where data is processed for direct-marketing purposes.
c) Right to withdraw consent with effect for the future
You may withdraw consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
d) Data portability
Where processing is based on a contract, pre-contractual negotiations or consent, or is carried out by automated means, you have the right to data portability. At your request, we will provide your data in a commonly used, structured and machine-readable format so that, if desired, you can transmit it to another controller.
e) No automated decision-making
Data subjects are not subject to automated decisions within the meaning of Article 22 GDPR by the controllers. If this should occur in an individual case, the data subjects concerned will be informed separately.
f) Restriction of processing
Data in relation to which we are unable to identify the data subject, for example because it has been anonymised for analytical purposes, is not covered by the rights set out above. Access, erasure, blocking, correction or transmission to another company may be possible in relation to such data if you provide us with additional information that enables us to identify you.
g) Exercising your rights and right to lodge a complaint
If you have questions about the processing of your personal data, or wish to request access, rectification, blocking, object to or request erasure of data, or request transmission of the data to another company, please contact
You also have the option of lodging a complaint with a supervisory authority in relation to your rights as a data subject.