Last updated October 2026
Privacy policy
This notice explains what personal data we process when you visit travel-token.net, why, and what rights you have under the EU General Data Protection Regulation (GDPR).
Controller
Travel Token Marketplace GmbH, Schopenstehl 20, 20457 Hamburg, Germany — [email protected].
Hosting and server log data
This website is hosted on DigitalOcean App Platform (DigitalOcean, LLC, New York, USA), in DigitalOcean's Frankfurt data centre (region FRA1); pages are delivered through the content delivery network that is part of that service. On each visit the hosting infrastructure automatically logs technical data: IP address, date and time, the page requested, the referring page, and browser and operating system. We use this data only to deliver the website and to keep it secure and stable, and do not merge it with other data. Log data is kept only for a short period and then deleted, unless it is needed to investigate a specific security incident. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a secure, working website). DigitalOcean processes the data on our behalf under a data processing agreement. Where data reaches DigitalOcean, LLC in the USA, the transfer is based on the EU-US Data Privacy Framework or, alternatively, on the EU standard contractual clauses.
Contact form
When you send us a message through the contact form, we process the details you enter (your use case, name, company, email address and, if you provide it, your phone number) together with the language of the page, the page on which your visit started and, if the link you followed contained them, its campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content). We use this data solely to handle your enquiry and to follow up on it. Legal basis: Art. 6(1)(b) GDPR where your enquiry relates to a contract or to steps prior to one, and otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering enquiries addressed to us). Recipients: your message is sent to our team by email through Resend (Resend, Inc., San Francisco, USA), which delivers the email on our behalf, and is recorded in a Google Sheet (Google Ireland Limited, Dublin, Ireland) that only the people handling enquiries can access. Both act as our processors under data processing agreements; transfers to the USA are based on the EU-US Data Privacy Framework or the EU standard contractual clauses. Retention: we delete your enquiry once it has been dealt with and no further contact is expected, at the latest two years after the last contact, unless it leads to a business relationship or statutory retention obligations apply.
Cookies and consent
On your first visit we ask whether you allow analytics. Your choice is stored in a first-party cookie on your device (cc_cookie, valid for six months) so that we do not have to ask again on every page. The consent tool (CookieConsent, open source) is served from our own server; it does not contact any third party. Storing your choice is strictly necessary to respect it (§ 25(2) no. 2 TDDDG; Art. 6(1)(c) and (f) GDPR). Without your consent we set no other cookies and use no other storage on your device. You can change or withdraw your choice at any time through "Cookie settings" at the bottom of every page; withdrawal does not affect the lawfulness of processing up to that point.
Google Analytics and Google Tag Manager
Only if you consent, we use Google Analytics 4, loaded through Google Tag Manager, to understand how our website is used (pages viewed, approximate origin, device and browser, how visitors arrived, and whether the contact form was sent) and to improve it. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Before you consent, neither Google Tag Manager nor Google Analytics is loaded and no request is made to Google. We also use Google Consent Mode, which passes your choice to Google's services. Google Analytics sets cookies (_ga, _ga_*) on your device; we do not use advertising features or Google Signals, and the data is not used for advertising. With your consent we also keep the campaign parameters of your first visit (utm_*) in your browser's local storage, so that an enquiry you send later can be attributed to the campaign that brought you here. Legal basis: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG. Data may be transferred to Google LLC in the USA; Google LLC is certified under the EU-US Data Privacy Framework, on the basis of which the European Commission has found an adequate level of data protection. Google Analytics data is deleted after 14 months. You can withdraw your consent at any time through "Cookie settings".
Fonts
The fonts on this website are served from our own server. No connection is made to Google Fonts or any other font service.
Your rights
You have the right to access, rectify, erase, or restrict the processing of your data, to data portability, and to object to processing based on legitimate interest. Where processing is based on your consent, you can withdraw it at any time with effect for the future. You may also lodge a complaint with a data protection supervisory authority, for example the Hamburg Commissioner for Data Protection and Freedom of Information. To exercise any of these rights, contact us at the address above.
Retention
Unless a period is stated above, we retain personal data only for as long as necessary for the purpose it was collected for, or as required by statutory retention obligations.