1. Who we are
The controller for the processing described in sections 3 to 6 under the EU General Data Protection Regulation (GDPR) is:
Adoptavia Germany UG (haftungsbeschränkt)
Brehmestr. 11
13187 Berlin
Germany
Email: info@cvcwebsolutions.com
Further company details are in our imprint. For any privacy question or request, email us at the address above.
2. Our two roles
Controller. We decide how and why we process the personal data of visitors to this website and of the people who hold accounts in My Travel Agency CRM (agency owners and staff). Sections 3 to 6 cover this processing.
Processor. Agencies use My Travel Agency CRM to manage their own business: contacts and enquiries, travellers, bookings and itineraries, quotes and invoices, payments, messages and emails. For this data the agency is the controller and we process it only on the agency’s behalf and instructions, under a data processing agreement in accordance with Art. 28 GDPR. A data processing agreement is available on request at info@cvcwebsolutions.com. Section 7 covers this processing.
If you are a client of a travel agency and want to know what data the agency holds about you, or want to exercise your rights, please contact the agency directly. If you contact us instead, we will pass your request on to the agency.
3. Visiting this website
Technical access data
When you open a page, your browser automatically sends technical information that is needed to deliver it: your IP address, the date and time, the page requested, the referring page and your browser and operating system. We process this data to deliver the website and to keep it secure and working (legal basis: Art. 6 (1) (f) GDPR, our legitimate interest in a functioning and secure website). The website and the app are hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in its data centres in Germany and Finland (EU).
To protect the sign-up form against abuse, the server keeps a short-lived count of sign-up attempts per IP address in memory. It is not written to a database.
Fonts
The typeface is served from our own servers with the site. Loading a page does not contact a third-party font service.
Cookies, browser storage and consent
This website does not set advertising or analytics cookies and does not load advertising or analytics tags. When you first visit, a consent banner lets you accept or reject non-essential cookies; your choice is saved in your browser’s local storage so the banner is not shown again. Signing in to the app sets a session cookie that is strictly necessary to keep you signed in.
If you arrive through a link that contains campaign parameters (UTM parameters) or an advertising click ID (from Google, Meta, LinkedIn or Microsoft) and you accept in the consent banner, the website stores those values in your browser’s session storage, which is cleared when you close the tab. If you reject, or have not yet chosen, they are not stored. This website does not currently send these values, or any other data about you, to us or to advertising platforms.
Details of each item are in our cookie policy.
4. Agency accounts
When you start a free trial we collect your agency’s name, your name, your email address and a password. Passwords are stored only as a salted hash. Colleagues you invite are given accounts in the same way. While your agency uses the service we process account data and the data needed to run the service for you, such as your role, settings and the records you create.
Legal basis: Art. 6 (1) (b) GDPR (performance of the contract with your agency, and steps before entering into it). Where you act for an agency, also Art. 6 (1) (f) GDPR, our legitimate interest in providing the service to the agency you work for.
5. Subscriptions and billing
Paid plans are billed through Stripe. When your agency subscribes, we create a customer record at Stripe with your agency’s name and the subscribing user’s email address, and you enter your payment details in Stripe’s checkout. Card details go directly to Stripe; we do not receive or store full card numbers. We store the Stripe customer reference and the status of your subscription. Legal basis: Art. 6 (1) (b) GDPR and, for keeping invoices and accounting records, Art. 6 (1) (c) GDPR together with German commercial and tax law.
6. Contacting us
If you email us, we process your email address, your message and any details you include to answer you (Art. 6 (1) (b) GDPR where your request relates to a contract, otherwise Art. 6 (1) (f) GDPR, our legitimate interest in answering enquiries).
7. Data agencies store about their clients
Agencies decide what they store in My Travel Agency CRM. Typically this includes contact details, traveller details for bookings, trip and booking information, quotes, invoices and payments, and messages and emails exchanged with clients. We process this data only to provide the service to the agency, as set out in the data processing agreement, and not for our own purposes. In particular:
- Shared inbox. If an agency connects a Google or Microsoft mailbox, the service reads and stores messages from that mailbox and sends replies through it, using access the agency grants through Google’s or Microsoft’s sign-in. The agency can disconnect the mailbox at any time.
- Client payments. If an agency takes card payments from its clients through the trip portal, the payment is processed by Stripe.
- AI features. If an agency user uses an AI feature, the text and record details needed for that request are sent to Anthropic to generate a response.
- Emails. Emails the agency sends to its clients through the service are delivered as described in section 8.
8. Service providers and recipients
We use the following service providers, only for the purposes described. Where they process personal data on our behalf (or, for data agencies store, as our sub-processors), they do so under data processing agreements in accordance with Art. 28 GDPR. Stripe also processes some payment data as an independent controller, for example to prevent fraud and to meet its own legal obligations.
- Hosting provider
- Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in its data centres in Germany and Finland (EU)Runs the servers and database that host this website and the app.
- Stripe
- Stripe Payments Europe Ltd. and its affiliates, including Stripe, Inc. (USA)Subscription billing for agencies (checkout and the billing portal), and card payments that an agency’s clients make in the trip portal.
- Twilio SendGrid
- Twilio Inc. (USA)Delivers emails sent by the service, such as account emails and the emails agencies send to their clients. Used when configured; otherwise emails are sent through our own mail server.
- Anthropic
- Anthropic PBC (USA)Generates text for the AI features (for example drafts, summaries and suggestions) when an agency user uses them. Only the content needed for that request is sent.
- Google Ireland Ltd. / Google LLC (USA)Gmail, only when an agency connects a Google mailbox to its shared inbox.
- Microsoft
- Microsoft Ireland Operations Ltd. / Microsoft Corporation (USA)Microsoft 365 / Outlook mail, only when an agency connects a Microsoft mailbox to its shared inbox.
We do not sell personal data. We disclose data to authorities only where we are legally obliged to.
9. Transfers outside the EU
Some of these providers are based in the USA or may process data there. Where a provider is certified under the EU-U.S. Data Privacy Framework, the transfer is based on the European Commission’s adequacy decision (Art. 45 GDPR). Otherwise we rely on the European Commission’s standard contractual clauses (Art. 46 (2) (c) GDPR). You can request a copy of the relevant safeguards from us.
10. How long we keep data
We keep personal data only for as long as we need it for the purpose it was collected for. Account data is kept while your agency’s account exists; data an agency stores is kept until the agency deletes it or its contract ends, after which it is deleted in line with the data processing agreement. Where the law requires us to keep records, such as invoices under German commercial and tax law, we keep them for the statutory period and restrict their use to that purpose. Technical access data is kept only as long as needed to operate and secure the website.
11. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you (Art. 15);
- have inaccurate data corrected (Art. 16);
- have data erased (Art. 17) or its processing restricted (Art. 18);
- receive your data in a portable format (Art. 20);
- object at any time to processing based on our legitimate interests, on grounds relating to your particular situation (Art. 21);
- withdraw any consent you have given, with effect for the future (Art. 7 (3)).
To exercise these rights, email info@cvcwebsolutions.com. For data an agency stores about you, the agency is responsible for answering your request (see section 2).
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects (Art. 22 GDPR).
12. Right to complain
You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work or where the alleged infringement took place. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), datenschutz-berlin.de.
13. Changes to this policy
We update this policy when our processing changes. The date at the top shows when it was last updated.