Privacy Policy

We are committed to protecting your personal data and your privacy. This statement explains what personal data we collect when you use our websites, why, and who else handles it. Personal data is any information that relates to you personally, such as your name, address, email address or how you use a website (hereinafter: ‘personal data’).

This privacy statement applies to all websites run by Berlin Experiences, including berlinexperiences.com, berlinexcursions.com and privatetoursofberlin.com. Changes to our services, to technology or to the law may require us to update it, so please check it from time to time. Last updated: 3 November 2026.

Who is responsible

The controller under Article 4(7) of the EU General Data Protection Regulation (GDPR) is Berlin Experiences DMC UG (haftungsbeschränkt), represented by its managing director Matthew Robinson, Gotlandstraße 10a, 10439 Berlin, Germany. For any question about this statement or your data, email info@berlinexperiences.com.

When you visit our websites

When you open one of our websites, your browser sends us technical data: your IP address, the date and time, the page requested, the page you came from, and your browser and operating system. We need this to show you the website and to keep it stable and secure. On berlinexperiences.com, Cloudflare sits in front of our server to deliver pages quickly and to block attacks, and processes the same data for that purpose. Server logs are kept only briefly, and we look at them only to investigate faults, attacks or suspected misuse, for example in connection with a booking. The legal basis for this is Article 6(1)(f) GDPR: our legitimate interest in a secure, working website.

Cookies and storage in your browser

berlinexperiences.com uses only the cookies it needs to work, such as the one that keeps you signed in if you have an account. Your saved tours, your basket and your cookie choice are kept in your browser’s local storage. These are strictly necessary for the services you ask for and need no consent (§ 25(2) no. 2 TDDDG). Analytics cookies are set only if you agree to them (see ‘Analytics’ below). berlinexcursions.com sets no cookies.

Enquiries and contact forms

When you send us an enquiry by email or through a form on one of our websites (such as the contact form on berlinexperiences.com or the excursion enquiry form on berlinexcursions.com), we receive what you enter: usually your name, email address and message and, depending on the form, your preferred date, group size, ship and port of call, interests and any accessibility needs. The form sends your enquiry by email to our info@ mailbox, and you receive a confirmation email. So that no enquiry gets lost, we also record your name and email address, and for enquiries from berlinexcursions.com the enquiry itself, in Twenty, the customer-relationship system we run on our own server. To stop the forms being misused, we count submissions per IP address for one hour; on berlinexcursions.com the address is stored only as a salted hash.

We use this data to answer you and to prepare any booking. The legal basis is Article 6(1)(b) GDPR (steps taken at your request before a contract) and otherwise Article 6(1)(f) GDPR (our legitimate interest in answering the messages we receive). We delete enquiries that do not lead to a booking once they are no longer needed, unless the law requires us to keep them.

Bookings

Tours are booked and paid for on berlinexperiences.com, as a guest or with an account. When you book, we collect your name, email address, phone number, billing address, the tour, date, start point and party size, and any notes you add. The fields marked as required are needed to book; everything else is optional. So that we can show what was agreed, at the moment of booking we also record your IP address, browser, language, time zone, the page you came from, and the version of our terms you accepted.

We use this data to run your tour, send your booking, reminder and invoice emails, issue your invoice, and handle any refund or payment dispute. Your guide and, if a driver is booked, your driver receive what they need to meet you: your name, phone number, start point and party size. Bookings are also recorded in Twenty. The legal bases are Article 6(1)(b) GDPR (performing our contract with you), Article 6(1)(c) GDPR (German tax and commercial record-keeping: invoices and booking records are kept for up to 10 years) and, for the booking evidence, Article 6(1)(f) GDPR (our legitimate interest in resolving payment disputes and chargebacks).

Analytics

Umami, which we host ourselves, counts page views on our websites without cookies and without storing personal data, so it needs no consent. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in knowing which pages are read.

On berlinexperiences.com we also use Google Analytics (Google Ireland Ltd.) for audience and traffic statistics and Microsoft Clarity (Microsoft Corporation) for anonymised session recordings and heatmaps that show us where pages are hard to use. Both set cookies and load only after you choose ‘Accept all’ in the cookie banner; if you choose ‘Reject all’, they are not loaded. You can change or withdraw your choice at any time with the ‘Cookie settings’ link at the bottom of every page. The legal basis is your consent under Article 6(1)(a) GDPR and § 25(1) TDDDG. Our other websites, including berlinexcursions.com, use only Umami and show no cookie banner.

Who else handles your data

We do not sell your data, and we pass it on only where the law requires it, where it is needed to perform your booking, or where you have agreed (Article 6(1)(a) to (c) GDPR). These service providers process data on our behalf, each under a data-processing agreement:

– Hostinger (Hostinger International Ltd., Cyprus): the server in Frankfurt am Main, Germany, that runs berlinexperiences.com, its booking database (Supabase, which we run ourselves), Twenty and Umami; the web hosting for berlinexcursions.com; and our info@ email mailbox.
– Cloudflare (Cloudflare, Inc.): fast delivery and attack protection for berlinexperiences.com.
– Stripe (Stripe Payments Europe Ltd.): card and other payments. We never see or store your full card details.
– Resend (Resend, Inc.): sends the emails from berlinexperiences.com, such as booking confirmations, reminders, invoices and contact-form messages.
– Google and Microsoft: analytics on berlinexperiences.com, only with your consent (see above).

Where a provider processes data outside the EU, the transfer is covered by the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses. We may also share personal data with authorities where the law requires it, such as under a court order, or where it is strictly necessary to prevent, detect or prosecute crime.

Your rights

You can ask us at any time, free of charge, for a copy of the personal data we hold about you (Article 15 GDPR), and to correct it (Article 16), delete it (Article 17), restrict its use (Article 18) or receive it in a portable format (Article 20). You can object to processing based on our legitimate interests (Article 21), and you can withdraw any consent you have given, with effect for the future. Records we must keep by law are deleted when the retention period ends. To use any of these rights, email info@berlinexperiences.com.

Protection of personal data

We use reasonable technical and organisational measures, including encryption, access controls and backups, to protect your personal data. Only a small number of people at Berlin Experiences can access, change or delete it.

Complaints, applicable law and jurisdiction

You have the right to complain to a data-protection supervisory authority (Article 77 GDPR). The authority responsible for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin. This privacy statement is governed by German law, and any dispute about it falls to the competent court in Germany.

Our apps

Our PastPresent app has its own privacy policy: the PastPresent app privacy policy.