Privacy notice

In this privacy notice, Bollig Tours s.à r.l. (hereinafter “we”, “us” or “Bollig Tours”) explains how we collect, use and process personal data in accordance with the EU General Data Protection Regulation 2016/679 (GDPR) and the Luxembourg Data Protection Act of 1 August 2018.

1. Controller responsible for data processing

Bollig Tours s.à r.l.
121, Route de Luxembourg
L-6562 Echternach, Luxembourg
RCS Luxembourg: B 104 999
Telephone: (+352) 72 97 22-1
Email: info@bollig-tours.lu

2. Personal data

2.1 Visiting our website

When visiting our website, technical access data automatically transmitted by your browser is collected. These are:

– IP address (anonymized)

– Date and time of access

– Accessed page / URL

– Browser type and operating system

– Referrer URL (previously visited page)

Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest) – to ensure the technical functionality and security of the website.

 

2.2 Contact form and travel inquiries

If you contact us via our contact form or by e-mail or request a trip, we process:

– First and last name

– E-mail address

– Telephone number (if provided)

– Travel preferences, travel destinations, desired travel dates

– Number of travelers

– Content of your message

Legal basis: Art. 6 para. 1 lit. b GDPR (contract performance / pre-contractual measures) and Art. 6 para. 1 lit. f GDPR (legitimate interest in responding to inquiries).

 

2.3 Booking and contract processing

If you book a trip, we process all data necessary for the performance of the contract, including:

– Personal identification data of all travelers (name, date of birth, nationality)

– Passport or ID card number (where legally required)

– Payment data (bank details / credit card information)

– Health conditions / special needs (only upon your explicit request)

– Emergency contact

Legal basis: Art. 6 para. 1 lit. b GDPR (contract performance).
For special categories of personal data (e.g. health data): Art. 9 para. 2 lit. a GDPR (explicit consent).

For booking processing, we transfer the necessary data to tour operators, airlines, hotels and other service providers. This transfer is strictly necessary for the performance of the travel contract.

2.4 Newsletter (CleverReach)

If you subscribe to our newsletter, we use the double opt-in procedure: after registration, you will receive a confirmation email in which you must actively confirm your subscription. Only then will you be added to our newsletter list.

We process the following data for sending the newsletter:

– E-mail address (mandatory field)

– First name (optional, for personalization)

– Date and time of registration and confirmation

– IP address at the time of registration (to prove consent)

Legal basis: Art. 6 para. 1 lit. a GDPR (consent). You can withdraw your consent at any time by clicking the unsubscribe link in every newsletter or by sending an e-mail to info@bollig-tours.lu. The withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Service provider: We use CleverReach GmbH & Co. KG, Schafjückenweg 2, 26180 Rastede, Germany, for sending newsletters. We have concluded a data processing agreement with CleverReach in accordance with Art. 28 GDPR. CleverReach is a European provider; your data is processed on servers in Germany and the EU. Privacy policy of CleverReach: www.cleverreach.com/de/datenschutz/

Our newsletters may contain tracking technologies (open and click tracking) to measure the success of our campaigns. We have activated privacy-compliant settings in CleverReach, where IP addresses are anonymized. You can restrict tracking by disabling images in your email program. Your data will be deleted within 1 month after unsubscribing from the newsletter, unless statutory retention obligations apply.

 

2.5 Job applications

If you apply via our website or by e-mail, we process your application documents exclusively for the purpose of the application procedure. The data will be deleted no later than 6 months after completion of the procedure, unless another legal basis exists.

Legal basis: Art. 6 para. 1 lit. b GDPR (pre-contractual measures) and Art. 88 GDPR in conjunction with Luxembourg labor law.

 

3. How we use information?

3.1 Que sont les cookies ?

Les cookies sont de petits fichiers texte qui sont enregistrés sur votre terminal lorsque vous visitez notre site web. Ils permettent de reconnaître votre navigateur lors d’une visite ultérieure.

3.2 Cookies techniquement nécessaires

Nous utilisons des cookies techniquement nécessaires, indispensables au fonctionnement du site web (par exemple les cookies de session ou les paramètres de langue). Ces cookies ne peuvent pas être désactivés.

Base juridique : Art. 6, paragraphe 1, point f) RGPD (intérêt légitime).

3.3 Google Analytics

Nous utilisons Google Analytics, un service d’analyse web fourni par Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irlande. Google Analytics utilise des cookies afin d’analyser la manière dont les visiteurs utilisent notre site web.

Nous avons configuré Google Analytics avec anonymisation de l’adresse IP, de sorte que votre adresse IP est raccourcie avant d’être transmise à Google. Les fonctions de remarketing de Google Analytics sont désactivées sur notre site. Dans des cas exceptionnels, une adresse IP complète peut être transmise à des serveurs de Google LLC aux États-Unis ; Google LLC est certifié dans le cadre du EU-US Data Privacy Framework.

Vous pouvez empêcher la collecte des données par Google Analytics en téléchargeant et installant le module complémentaire de navigateur suivant : tools.google.com/dlpage/gaoptout

Base juridique : Art. 6, paragraphe 1, point f) RGPD (intérêt légitime à l’optimisation du site web). Nous vous informons de cette utilisation dans notre bannière de cookies et vous offrons la possibilité de donner ou de refuser votre consentement.

3.4 Gestion des paramètres des cookies

Vous pouvez à tout moment adapter l’utilisation des cookies via les paramètres de cookies disponibles sur notre site web. En outre, vous pouvez désactiver l’enregistrement des cookies dans les paramètres de votre navigateur. Veuillez noter que cela peut affecter le bon fonctionnement de notre site web.

4. Third parties and processors

We use the following external service providers with whom we have concluded data processing agreements in accordance with Art. 28 GDPR:

Service providers
Purpose
Location / note

WordPress.org

Website hosting and content management

USA / EU servers; wordpress.org/about/privacy/

CleverReach GmbH & Co. KG

Newsletter sending and email marketing

Germany (EU); DPA concluded

Google Ireland Ltd.

Google Analytics (website analysis)

Ireland / USA (EU-US DPF certified)

Tour operators and service providers

Booking processing and travel execution (e.g. LuxairTours, Marco Polo, Studiosus)

EU/international; data transfer based on the travel contract

We do not share your data with third parties for advertising or marketing purposes. Data is only shared with travel providers to fulfill the contract.

5. Retention periods

We store your personal data only for as long as necessary for the respective purpose or as required by statutory retention obligations:

– Booking and invoice data: 10 years (tax retention obligation under Luxembourg law)

– Travel inquiries (without booking completion): 6 months after completion of the communication

– Newsletter subscribers: until withdrawal of consent; after unsubscription deletion within 12 months, unless statutory retention obligations prevent deletion

– Job application documents: 6 months after completion of the application process (in case of rejection), unless another legal basis exists

– Server log files: 14 days (anonymized data may be stored longer for statistical evaluations)

6. Your rights as a data subject

As a data subject, you have the following rights under the GDPR:

– Right of access (Art. 15 GDPR): You have the right to obtain information about the personal data we have stored about you

– Right to rectification (Art. 16 GDPR): You may request the correction of incorrect or the completion of incomplete data

– Right to erasure (Art. 17 GDPR): You may request the deletion of your personal data, provided that no legal retention obligations prevent this

– Right to restriction of processing (Art. 18 GDPR): You may request the restriction of processing of your data in certain cases

– Right to data portability (Art. 20 GDPR): You have the right to receive your data in a structured, commonly used and machine-readable format

– Right to object (Art. 21 GDPR): You may object to the processing of your data based on legitimate interests. In the case of direct marketing, you have an unrestricted right to object

– Right to withdraw consent (Art. 7 para. 3 GDPR): You may withdraw your consent at any time with effect for the future

To exercise your rights, please contact: info@bollig-tours.lu or in writing to Bollig Tours s.à r.l., 121, Route de Luxembourg, L-6562 Echternach.

7. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint at any time with the competent data protection authority:

Commission nationale pour la protection des données

15, Boulevard du Jazz

L-4370 Belvaux

Luxembourg

Tel.: (+352) 26 10 60 -1

E-Mail: info@cnpd.lu

Website: www.cnpd.lu

8. Data security

We implement technical and organizational security measures to protect your data. Our website uses SSL/TLS encryption (recognizable by “https://” and the lock symbol in your browser).

9. Changes to this privacy notice

We reserve the right to amend this privacy notice if necessary, for example in the event of changes to our website or legal requirements. The current version is always available on our website. We recommend reviewing this notice regularly.

 

Status: April 2026