This privacy policy explains how we process your data when you use our website www.veriva.travel (“Website”) and make use of our services.

1. Name and address of the data controller

The data controller within the meaning of Article 4(7) of the GDPR is:
Veriva Travel GmbH
Bielitzer Str. 18
81377 Munich
Email address: lh@veriva.travel

2. Provision of the website

2.1 Description and scope of data processing

Every time you visit our website, our system – i.e. the web server – automatically collects information from your computer or device.

We collect the following data in this process:

• IP address,
• information about the browser type and version used,
• operating system of the device,
• Internet service provider,
• date and time of access.

2.2 Purpose of data processing

The collection and further processing of your IP address by our system is necessary to enable you to use our website.

2.3 Legal basis for data processing

The legal basis for the processing of this data is Article 6(1)(f) of the GDPR (balancing of interests). Our legitimate interest is to provide a fully functional website.

2.4 Duration of storage

We delete the data as soon as your session on our website has ended. Our hosting provider Infomaniak keeps logfiles at least 7 days.

2.5 Recipients of the data

We use the external service provider Infomaniak Network AG to operate the Website.

3. Contact form or enquiries by email

3.1 Description and scope of data processing

You can contact us via our contact form and the email address provided. In this case, we process the personal data you provide with your enquiry.

3.2 Legal basis for data processing

The legal basis for the processing of the data provided in this enquiry is Article 6(1)(f) of the GDPR (balancing of interests). Our legitimate interest is the communication between our company and you as the enquirer. If the enquiry is aimed at concluding or performing a contract, the additional legal basis for the processing is Article 6(1)(b) of the GDPR (performance of a contract or the implementation of pre-contractual measures).

3.3 Purpose of data processing

We process the personal data provided via the contact form or in your email solely for the purpose of handling your enquiry and communicating with you.

3.4 Duration of storage

The personal data associated with your enquiry will be deleted as soon as it is no longer required to fulfil the purpose for which it was collected. We will delete the personal data that you have sent to us by email or via the contact form once it is clear from the circumstances that the matter in question has been conclusively resolved.

4. Newsletter

4.1 Description and scope of data processing

On our Website, you have the option to subscribe to a newsletter. To subscribe, you must provide us with your email address. If you are a Veriva Partner, you will automatically receive the newsletter from the start of our contractual relationship.

4.2 Legal basis for data processing

The legal basis for the processing of your data is your consent. For Veriva Partners, the legal basis is our legitimate interest in keeping partners up to date with our products.

4.3 Purpose of data processing

The purpose of data processing is to provide you with the newsletter.

4.4 Duration of storage

We will only store your email address for the purpose of sending you the newsletter for as long as your subscription to the newsletter remains active.

4.5 Right to object

You can unsubscribe from the newsletter at any time. Each newsletter contains a link allowing you to unsubscribe.

5. Website analytics

5.1 Description and scope of data processing

We use the website analytics tool Plausible Analytics and Rank Math on our Website. This enables us to track how many users visit our Website and how different sections of the Website are used.

5.2 Legal basis for data processing

The legal basis for data processing is Article 6(f) of the GDPR (legitimate interest). Our legitimate interest is to design our Website in a way that meets users’ needs.

5.3 Purpose of data processing

The purpose of data processing is to design our Website in line with user needs.

5.4 Duration of storage

We store the data collected for website analysis for 24 months.

5.5 Recipients of the data

Name	Registered Office	Role	Retention Period
Plausible Insights OÜ (“Plausible Analytics”)	Västriku tn 2, 50403 Tartu, Estonia	Web analytics service provider (cookie-free; processes hashed/anonymised visitor data)	No persistent identifiers stored; aggregated statistics retained per account settings (max. 12–24 months, configurable)
Rank Math Private Limited (“Rank Math SEO”)	EC-320, Pkt EC G-8, Area Rajouri Garden, Hari Nagar, New Delhi 110064, India	SEO/schema plugin provider; relevant only if cloud-based features (e.g. Content AI, Search Console sync) are enabled	Per Rank Math’s own data policy; India is a third country without EU adequacy decision — confirm transfer safeguards before enabling cloud features
Cloudflare, Inc. (“Cloudflare”)	101 Townsend Street, San Francisco, CA 94107, USA (EU entity: Cloudflare Germany GmbH, Rosenheimer Str. 143C, 81671 Munich, Germany)	CDN / firewall / DDoS protection; processes visitor IP addresses for every request before they reach the hosting server	Per Cloudflare’s DPA; logs typically retained per configured retention (commonly up to 30 days unless otherwise set); transfer to US under Cloudflare’s DPA/SCCs — confirm current mechanism with counsel
Sendinblue SAS (“Brevo”)	17 rue de Salneuve, 75017 Paris, France	Newsletter / email marketing platform; processes subscriber e-mail addresses and engagement data	Until consent is withdrawn / unsubscribe, per Brevo’s retention policy — confirm exact period with Brevo’s DPA before publishing

6. Login area

6.1 Description and scope of data processing

We offer Veriva Partners the option of creating a user account on our website by providing personal data. In your user account, you can fill out our Compass questionnaire.

We collect the following data as part of the registration process:

• Username
• Password
• Email address
• Name
• Address

We collect the following data as part of the login process:

• Username
• Password

We collect the following data when you use your user account:

We collect data related to how regenerative (positive impact) the property evaluated is. Therefore, the data is mainly tourism impact data. Included is also general property data like number of rooms, name of property, country it is in, continent, region, number of staff, ownership, number of annual guests and property type.

6.2 Legal basis for data processing

The legal basis for the processing of the data is Article 6(1)(b) of the GDPR (performance of a contract), as registration and the user account are necessary for the performance of the contract or for the implementation of pre-contractual measures.

6.3 Purpose of data processing

The user account serves the purpose of providing unique access to our Compass questionnaire only for our partners in an area accessible only to registered users.

6.4 Duration of storage

Data is usually stored for 3 years.

6.5 Recipients of the data

Possible recipients of the derived data are universities, research institutions, investors, DMOs, OTAs, Data Hubs, LLMs, Tour Operators, travel agencies or hotel collections.

7. Provision of our services

7.1 Description and scope of data processing

If, as a Veriva Partner, you use our services, we process various items of personal data that you provide, e.g. your name, your address and other data that you provide to us in the course of our collaboration.

7.2 Legal basis for data processing

The legal basis for the processing of your data is Article 6(1)(b) of the GDPR (performance of a contract), as the processing of your data is necessary for the performance of the contract or for the implementation of pre-contractual measures.

7.3 Purpose of data processing

The purpose of data processing is to provide our services.

7.4 Duration of storage

We generally store this data for the statutory limitation period of 3 years following the end of our working relationship with you. Where we are obliged to do so under tax and commercial law, we store this data for a period of up to 10 years.

7.5 Recipients of the data

In order to provide our services, it may be necessary for us to pass on your data to other partners (e.g. Investors, OTAs, DMOs, Tour Operators, travel agencies, hotel collections, LLMs or Universities).

8. Data subject rights

If your personal data is processed, you are a ‘data subject’ within the meaning of the GDPR. You have the following rights vis-à-vis us as the data controller:

• You have the right to obtain information about the personal data we hold about you (Article 15 of the GDPR), the right to rectification (Article 16 of the GDPR), the right to erasure (Article 17 of the GDPR) and the right to restriction of processing of your personal data (Article 18 of the GDPR). Furthermore, you are entitled to exercise your right to data portability (Article 20 of the GDPR).
• Under Article 21 of the GDPR, you have the right at any time to object to the processing of your personal data carried out pursuant to Article 6(1)(e) or (f) of the GDPR.
• If you have given us your consent, you may withdraw it at any time without this affecting the lawfulness of the processing carried out on the basis of your consent prior to its withdrawal.

9. Necessity of providing personal data

The provision of your personal data is not required by law or by contract, and you are not obliged to provide us with personal data. However, without the provision of personal data, we cannot enter into contracts with you.

10. Automated decision-making

We do not process your data as part of any automated decision-making.

11. Information on lodging a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or the place where the alleged infringement occurred, if you consider that our processing of your personal data infringes the GDPR.