Privacy Policy

Effective Date: 11/08/2025

This Privacy Policy may be updated at any time. The latest version is always available on our website.

1. Data Controller and Privacy Contact

Paperplane Collective UG (haftungsbeschränkt)
Belgradstr. 68
80804 Munich, Germany
Email: info@paperplane-collective.com
Phone: +49 15152452142

Represented by the Managing Directors: Niclas Ondrak and Pascal Lengauer.
For any privacy-related inquiries, please contact Niclas Ondrak at N.Ondrak@paperplane-collective.com.

2. Collection and Storage of Personal Data

We collect and process personal data when you:

  • Visit our website (e.g., IP address, browser data for technical operation)
  • Fill out the contact form (e.g., name, email address to respond to your inquiry)
  • Sign up for our newsletter (e.g., email address for delivery)
  • Book a retreat spot (e.g., name, address, payment details for contract processing)
  • Contact us by email or phone (e.g., phone number for call-backs)

Additionally, during booking we may collect special categories of personal data, such as health data (e.g., allergies or intolerances) to ensure appropriate catering and participant safety during the retreat. Such data is only processed with your explicit consent.

3. Purpose of Processing

  • Responding to inquiries
  • Carrying out and processing bookings
  • Processing payments
  • Organizing and running the retreat, including consideration of individual dietary and health requirements
  • Fulfilling legal obligations (e.g., tax retention periods)
  • Marketing purposes (newsletter, with consent)
  • Improving our website

4. Legal Bases

  • Contract fulfillment (Art. 6(1)(b) GDPR): For the performance of the retreat, booking, and payment processing.
  • Legal obligation (Art. 6(1)(c) GDPR): For compliance with statutory retention and documentation requirements.
  • Legitimate interest (Art. 6(1)(f) GDPR): For improving our website, analyzing user behavior, and marketing, provided your fundamental rights do not override these interests.
  • Consent (Art. 6(1)(a) GDPR): For newsletter subscriptions and the use of cookies for analytics or marketing.
  • Health data (Art. 9(2)(a) GDPR): Processed only with your explicit consent, e.g., for organizing specific meals or ensuring safety during the retreat.

5. Data Sharing

Your data will only be shared if:

  • It is necessary to fulfill the contract, e.g., with:
    • Accommodation providers
    • Transport companies
    • Local tour guides
    • Catering or event service providers
  • It is required by law
  • You have given your consent
  • We use service providers (e.g., payment processors, IT providers) bound by data processing agreements

6. Data Transfer to Third Countries

As our retreat takes place in Vietnam, data may be transferred to partners outside the EU. Such transfers are based on:

  • Standard Contractual Clauses under Art. 46 GDPR, or
  • Your explicit consent under Art. 49(1)(a) GDPR

Transfers are made only to the extent necessary to provide the agreed services.

7. Data Retention

We store personal data:

  • For the duration of the contractual relationship
  • As long as legal retention periods apply (usually 6 or 10 years under tax law)
  • Until you withdraw your consent (for newsletters or health data)

8. Your Rights as a Data Subject

  • Access to your stored data
  • Rectification or deletion of your data
  • Restriction of processing
  • Objection to processing
  • Data portability
  • Lodging a complaint with a supervisory authority

Supervisory authority in Bavaria: Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.

9. Data Security

We use technical and organizational measures to protect your data from loss, misuse, or unauthorized access. This includes encrypted data transmission (SSL/TLS), access restrictions, and regular backups.

10. Cookies & Tracking

We use cookies in the following categories:

  • Necessary cookies: For the technical operation of the website.
  • Functional cookies: For enhanced website functionality.
  • Analytics and marketing cookies: For measuring reach and personalizing content (e.g., Google Analytics, Facebook Pixel).

You can adjust your cookie preferences at any time through our cookie consent tool.

11. Payment Processing

We use [Visa / PayPal] for payment processing. Payment data is transmitted directly to the payment provider and is not stored on our servers. The provider’s own privacy policy applies.

12. Contact Form

Data entered via the contact form is used solely to process your inquiry and will not be shared with third parties unless necessary for handling your request.

13. Changes

We reserve the right to amend this Privacy Policy at any time. The latest version is always available on our website.