Privacy policy
This privacy policy was last updated on 6 August 2026 and applies to individuals residing in the European Economic Area and Switzerland. It explains how we process personal data on this website (https://www.weisseflotte-heidelberg.de) and reflects the technology actually used.
Protecting your personal data is important to us. Among other things, we clearly state our processing purposes, limit collection to what is needed, obtain consent where required, apply appropriate security measures, and respect your rights of access, rectification and erasure.
1. Controller
Weisse Flotte Heidelberg GmbH & Co. KG
Neckarstaden 25
69117 Heidelberg
Germany
Email: info@weisseflotte.com · Phone: +49 6221 20181
2. Purposes, data and retention
2.1 Contact by phone, post, email and/or web forms
Data: name, email address, phone number, IP address.
Legal basis: consent (Art. 6(1)(a) GDPR) or, for contract-related enquiries, Art. 6(1)(b) GDPR.
Retention: generally 18 months after the matter ends.
2.2 Payments and ticketing
Data: name, email address, IP address and other data required for payment/ticketing.
Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
Retention: until the service ends or statutory retention periods expire.
2.3 Support for services and products
Data: name, email, phone number, IP address as needed to handle your request or booking.
Legal basis: Art. 6(1)(b) or Art. 6(1)(a) GDPR.
Retention: until the service or request is completed.
2.4 Website statistics
Data (only after consent): IP address (truncated/anonymised where possible), usage data, approximate geolocation.
Legal basis: consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).
Retention: until you withdraw consent or according to the analytics tools’ settings.
2.5 Personalised offers and marketing
Data (only after consent): contact details, IP address, usage and geolocation data as needed.
Legal basis: consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).
Retention: until you withdraw consent.
2.6 Newsletter
Data: email address and, where provided, name.
Legal basis: consent (Art. 6(1)(a) GDPR).
Retention: until you unsubscribe. Sending may use Klaviyo (Klaviyo, Inc.); Klaviyo’s privacy notice applies in addition.
3. Hosting (Vercel)
This website is hosted by Vercel. Technically necessary server log data (e.g. IP address, time, page requested) is processed to provide the service securely (Art. 6(1)(f) GDPR). A data processing agreement is in place.
4. Self-hosted fonts & icons
Fonts (Figtree, JetBrains Mono) and icons (Font Awesome) are served from our own server. No connection to Google Fonts or other external font services is made.
5. Saved cruises (local storage)
Saved cruises are stored only locally in your browser (local storage), without an account and without transfer to us or third parties.
6. Consent & analytics (Consent, Google Tag Manager, PostHog)
Analytics and marketing services (e.g. Google Analytics via Google Tag Manager, and PostHog) are loaded only after your explicit consent via our consent banner (Consent Mode v2). Without consent, these services are not activated (Art. 6(1)(a) GDPR, § 25(1) TDDDG).
A data processing agreement with Google is in place. Google may not use the data for other Google services. Full IP addresses are truncated/blocked where supported. You can withdraw consent at any time:
7. Booking via FareHarbor
Bookings are processed via FareHarbor (FareHarbor Holdings, Inc. / FareHarbor B.V., Netherlands) for payment and ticketing. When you open the booking window, a connection to FareHarbor is established and the data you enter is processed to fulfil the contract (Art. 6(1)(b) GDPR). FareHarbor’s privacy notice applies in addition.
8. Cruise & schedule data (TourOS)
Cruises and dates are loaded server-side from our management system (TourOS). No personal data of website visitors is transferred to TourOS.
9. Embedded forms (TourOS charter/groups)
Charter and group pages may embed TourOS forms. A connection is established when the form loads; data you enter is processed to handle your enquiry (Art. 6(1)(b) GDPR).
10. Cookies
This website uses cookies and similar technologies. See ourcookie policy for details.
11. Sharing and disclosure
We share personal data with processors only as needed for the purposes above (including FareHarbor, Vercel, Google/PostHog after consent, and Klaviyo for the newsletter where used).
We disclose personal data when required by law or court order. In a merger or sale of the business, data may be disclosed to advisers and prospective buyers and transferred to new owners.
12. Security
We take appropriate security measures against misuse and unauthorised access, including DNS security (DKIM, SPF, DMARC), HTTP Strict Transport Security and related headers, and TLS/SSL encryption. Access is limited to those who need it and is reviewed regularly.
13. Third-party websites
This policy does not apply to third-party websites linked from our site. Please read their privacy notices before using them.
14. Changes
We may update this privacy policy. Please review it regularly. We will inform you of material changes where possible.
15. Your rights
You have the right to access, rectification, erasure, restriction, data portability and objection, as well as the right to withdraw consent and to lodge a complaint with a supervisory authority. Please clearly identify yourself when making a request.
16. Contact
Weisse Flotte Heidelberg GmbH & Co. KG
Neckarstaden 25, 69117 Heidelberg
Email: info@weisseflotte.com
Phone: +49 6221 20181