Your data in short

Key takeaways

Every page of Komodo Day Tour can be read without an account. The site sets no cookies and runs no analytics, advertising or tracking scripts. What does reach us is the connection data any web server sees when it delivers a page, described below.

Nothing is booked on this website. Picking a tour sends you to GetYourGuide, where you reserve it and where their privacy rules apply.

Who runs this website

Komodo Day Tour
[email protected]

We have no legal duty to appoint a data protection officer and have not appointed one. For any question about your data, write to [email protected].

What the server notes

Each time your browser asks for a page or a file, our web server logs the IP address behind the request, the date and time, the address requested, the page you arrived from and the identifying text your browser and operating system send.

We need these records to deliver the site, keep it stable, detect attacks and misuse, and count how often each page is read. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in a site that works and stays safe. Raw records are removed after 90 days at the latest; counts without IP addresses are kept longer. A hosting company runs the server and processes this data only on our instructions.

The provider shielding this website

Pages and email of this domain run through Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA), which delivers the site quickly, filters out attacks and relays email to our mailbox. For that purpose Cloudflare handles your IP address and technical connection data.

The legal basis is Article 6(1)(f) GDPR, our interest in a fast, protected site. Cloudflare is certified under the EU-US Data Privacy Framework, and the European Commission's standard contractual clauses apply in addition. Cloudflare describes its own handling at cloudflare.com/privacypolicy.

Pictures of the trips

Photographs of the tours come straight from the image servers of GetYourGuide (GetYourGuide Deutschland GmbH, Sonnenburger Straße 73, 10437 Berlin, Germany). Showing one means your browser calls those servers and hands over your IP address, which we cannot influence.

The legal basis is Article 6(1)(f) GDPR: our interest is to display every tour with its provider's current pictures.

At the moment you press book

The booking links go directly to GetYourGuide. Every link contains our partner number, which lets the platform credit us for a booking made through it.

After you arrive on GetYourGuide, that platform places its own cookies and processes your data under its own privacy policy. What reaches us from them are commission reports containing totals alone: no names, no contact details, no payment data.

Films on the pages

Videos use YouTube's privacy-enhanced mode and show a still image until you press play, with no contact to YouTube before that. After you press play, the video loads from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), which receives your IP address and may set cookies.

Pressing play counts as consent: Article 6(1)(a) GDPR and Section 25(1) TDDDG. Google's privacy policy: policies.google.com/privacy.

What your browser holds

A few small notes live in your browser so the site follows your choices. They never leave your device, and we are unable to read them:

• the checklist boxes you ticked, kept so they are still ticked on your return (local storage, until you clear it);
• the currency picked in the menu, so each page shows prices in it (local storage, until you clear it);
• for a chat you opened: its reference number, an access key, your email address and the conversation, so it can be resumed (local storage, until you clear it);
• a flag that the chat bubble was already displayed, so it is not repeated (session storage, dropped when the tab closes);
• a flag that the window offered at departure was already displayed, so it is not repeated (session storage, dropped when the tab closes).

These entries are needed purely for functions you switch on yourself (Section 25(2) No. 2 TDDDG). You can wipe them at any moment in your browser settings.

Chat messages

Opening a chat means handing us your name, your email address and your messages. The chat service also logs the country of your connection, a scrambled form of your IP address (a salted hash that cannot be reversed into the address), and the page and language you wrote from.

The conversation is kept with Cloudflare (named above), and each message you write is relayed to our account on the Telegram messaging service, which handles it outside the European Union; our replies return by the same path. More at telegram.org/privacy. Your email address serves one purpose here: our reply.

The legal basis is Article 6(1)(b) GDPR, because you ask and we answer, and Article 6(1)(f) GDPR for the scrambled IP address, which serves only to stop abuse and spam. Each conversation is removed automatically 180 days after its last message.

Mail to us

If you write to us, we use the message only to answer you. The legal basis is Article 6(1)(f) GDPR, and Article 6(1)(b) GDPR if your message concerns a contract. When the exchange ends we delete it, unless the law requires us to retain it.

Type and maps

The typefaces are served from our own server, so no font provider hears of your visit. The maps are pictures held on our server and drawn from OpenStreetMap data; viewing or enlarging them calls no map service. A "Google Maps" link opens Google only when you press it.

Links out to references

Our pages cite official and expert sources and link to them. Those sites get nothing unless you open a link, and then their own privacy rules apply.

Your rights, and how to use them

You may ask which data we hold about you (Article 15 GDPR), have it corrected (Article 16) or erased (Article 17), have its processing restricted (Article 18) and receive it in a portable form (Article 20). Where we rely on legitimate interest you may object at any time (Article 21), and consent you gave can be withdrawn for the future. A short email to [email protected] suffices.

You also have the right to lodge a complaint with a data protection supervisory authority, particularly in the EU country where you live or work, or where you believe the infringement happened (Article 77 GDPR).

We make no automated decisions about you and build no profiles. You do not have to give us data, but without the technical connection data a page cannot be sent to your screen.