Privacy Policy

Privacy Policy of Kaiyuan Information & Business GmbH

Preamble: Importance of Data Protection

Kaiyuan Information & Business GmbH takes the protection of your personal data very seriously. We want you to know when we store which data and how we use it. We pay close attention to this aspect when implementing our internet activities. The following statement provides an overview of how we ensure the protection of your personal data and fulfill our information obligations towards you regarding data collection and processing.

"Kaiyuan" (referred to in this policy as "we", "us", "our", or "Kaiyuan") refers primarily to Kaiyuan Information & Business GmbH and, if applicable, other companies within the group.

This policy is drafted in German and Chinese. In the event of any conflict between these two languages, the German version shall be binding and prevail.

What is Personal Data?

Personal data refers to any information that can be used to identify you. This includes details such as your name, contact details, WeChat ID, booking reference number, passport and residence identification details, payment data, IP address, and email address.

What is Anonymized Data?

Each time you access our online content, general information is automatically stored (e.g., number and duration of visits to individual pages, etc.). This data is not personally identifiable and is therefore processed in anonymized form. Information of this kind is used exclusively for statistical purposes and to optimize our website presence and service offerings.

What Data Do We Collect From You?

We may collect personal data about you when you book services with us or through our agents, use our website and/or app or other websites accessible through them, participate in a survey or contest, or contact us.

We collect personal data from you to process the offers and services you select. This occurs particularly when booking a trip, but also through filling out forms, participating in contests, subscribing to newsletters, taking part in opinion polls, evaluating travel services or tour guides, transmitting emails, or using online services.

Specifically, we may collect the following types of data:

• Contact information: name, address, email address, WeChat ID, phone number, etc.;
• Additional customer and passenger information, including nationality, date of birth, gender, passport number, and other details from passports or recognized identity documents;
• Health condition details for passengers requiring medical assistance and/or specific dietary arrangements;
• Travel itinerary, including flight details and services booked in connection with your trip;
• Information regarding your purchases of products and services from our trusted partners;
• Information about your usage of our website and/or app;
• Communications you exchange with us or send to us via letters, emails, chat services, phone calls, and social media.

Please note that personal data of fellow travelers may also be collected, especially when booking tourism services. You should therefore ensure that all third-party information is provided with their explicit consent.

How Do We Use and Process Your Personal Data?

The business of our company is the sale of global tourism services and related agency, billing, and customer support services. Data collection, processing, and use are carried out to fulfill these purposes.

If your personal data is collected and processed in connection with booking a travel service, we use it within the scope of the contractual relationship to deliver the associated services, including: hotel reservations, purchasing and reserving destination tickets, reserving travel tickets (flights, trains, ferries, etc.), tour guide services, cruise bookings, VAT refunds, vouchers, tour bus rentals, airport pick-up services, car rentals, and more.

Data processing for advertising purposes takes place strictly within the legal framework. For newsletter subscriptions, we process your data to compile and send the content. You can object to the use of your data in this context at any time. We will explicitly inform you of your right to object whenever your data is used for advertising or marketing, or provide a simple unsubscribe mechanism (e.g., a link).

To Whom Do We Disclose Your Personal Information?

To execute and manage our tourism services, we forward your personal data to relevant service providers (e.g., airlines, hotels, car rental agencies, retailers, branch offices, ticket providers, tour guides, billing providers, travel insurance, tax-free agencies, and resellers) as well as subsidiaries to fulfill contractual obligations.

In the context of contests, we forward your data to the respective partner to the extent necessary to redeem a prize.

Personal data is shared strictly within legal limits and only when necessary for processing your booking or the associated payment process. In all other cases, only anonymized data that does not allow any inference to your identity is transferred.

We explicitly do not sell personal data to third parties.

How Do We Process and Transfer Data within Our Global Services?

Kaiyuan transfers information globally, both to countries within the EU and outside the EU. Collected data may also be stored in other locations in accordance with this policy. These data transfers are necessary to provide the services specified in Kaiyuan’s terms of use and to operate globally. To legally transfer data from the European Economic Area (EEA) to other countries or regions, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission or adequacy decisions where applicable.

What Is Our Legal Basis for Processing Data?

We collect, use, and share the aforementioned personal data in accordance with the provisions of the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). Data processing is considered lawful only if at least one of the following conditions applies:

1. Consent of the user (the user may revoke consent at any time by contacting our Data Protection Officer) (Art. 6 (1) (a) GDPR);
2. Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps prior to entering into a contract (Art. 6 (1) (b) GDPR);
3. Processing is necessary for compliance with a legal obligation (Art. 6 (1) (c) GDPR);
4. Processing is necessary to protect the vital interests of the data subject or another natural person (Art. 6 (1) (d) GDPR);
5. Processing is necessary for the performance of a task carried out in the public interest (Art. 6 (1) (e) GDPR);
6. Processing is necessary for the legitimate interests pursued by the controller or a third party, except where overridden by the interests or fundamental rights and freedoms of the data subject (Art. 6 (1) (f) GDPR).

Right of Access / Your Rights

You have the right to request information about your stored personal data free of charge. Furthermore, you have the right to request the rectification, deletion, or restriction of inaccurate data, subject to statutory retention obligations.

Offline Copy Request for Data Download

If you require an offline copy of your personal data, you may submit a written request via email to our Data Protection Officer at any time. We will transmit this offline copy as an archived attachment via email within 30 days of receiving your request.

How Long Do We Store Your Data?

We store your data until you submit a request to delete your account, or at least for the duration required by statutory retention obligations. To request account deletion, you may contact our Data Protection Officer via email at any time.

How Do We Protect Your Data?

To process your personal data as securely as possible, we use SSL (Secure Socket Layer) encryption software for data transmission between your computer and our server, particularly when using our online services.

Your personal data is stored exclusively in accordance with statutory provisions within the Federal Republic of Germany and, where applicable, China. When transferring data to service providers within the scope of services described, they are bound by contractual privacy obligations in addition to mandatory legal regulations.

All Kaiyuan GmbH employees handling customer data undergo regular training and awareness programs regarding the proper processing of personal data.

Data Controller / Data Protection Officer

Kaiyuan Information & Business GmbH is the controller responsible for data storage and processing, as well as the service provider. Details and contact options are listed below:

Data Protection Officer (DPO)

Kaiyuan Information & Business GmbH
Hackerbrücke 6
80335 Munich
Email: datenschutz@kaytrip.com

For questions, requests, or comments regarding data protection, please contact the Data Protection Officer of Kaiyuan GmbH via email: datenschutz@kaytrip.com

How Do We Notify You of Changes to This Policy?

We reserve the right to amend or supplement this policy as necessary. We will notify users before changes take effect, allowing customers to review the updated policy prior to continuing the use of our services.

Liability

Despite careful content verification, no liability can be accepted for the accuracy, completeness, or timeliness of these web pages. In particular, Kaiyuan assumes no liability for damages or consequences arising directly or indirectly from the use of the content provided.

Supplementary Information on Data Processing on This Website

The following sections supplement and specify the preceding statement regarding the operation of this website. In the event of discrepancies, the following details shall prevail.

Server Log Files

When accessing this website, information automatically transmitted by your browser is recorded: page accessed, date and time of access, volume of data transferred, referrer URL, browser type and version, operating system, and IP address. The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in the technically error-free operation and security of the website. Data is deleted after 30 days. This data is not combined with other data sources.

Contact via This Website

When you contact us via email or phone, we process the information you provide to handle your inquiry. Legal basis is Art. 6 (1) (b) GDPR if the request relates to entering into or fulfilling a travel contract, otherwise Art. 6 (1) (f) GDPR based on our legitimate interest in responding to inquiries. Your data will be deleted once your request has been fully resolved, provided no statutory retention requirements apply.

Hosting

This website is hosted by an external service provider. The provider processes data generated during website visits on our behalf under a Data Processing Agreement (DPA) pursuant to Art. 28 GDPR.

Fonts, Cookies, and Analytics

This website uses fonts stored exclusively locally on our server. No connection to third-party servers, particularly Google Fonts, is established. No cookies are set, and no analytics or tracking services are used. Consent under Section 25 TDDDG is therefore not required.

Data Transfer to the People's Republic of China

For the preparation and execution of trips to the People's Republic of China, transferring personal data to our local offices and service providers on-site is required—specifically names, passport data, dates of birth, travel itineraries, and health requirements where applicable. Legal basis is Art. 6 (1) (b) GDPR in conjunction with Art. 49 (1) (b) GDPR, as the transfer is necessary for the performance of the travel contract. There is no adequacy decision by the European Commission for the People's Republic of China. Specific recipients will be disclosed during the booking process. Data is not transferred to China upon mere inquiries made via this website.

Your Rights

You have the right to access your stored personal data (Art. 15 GDPR), right to rectification (Art. 16 GDPR), right to erasure (Art. 17 GDPR), right to restriction of processing (Art. 18 GDPR), right to data portability (Art. 20 GDPR), and right to object (Art. 21 GDPR). You may withdraw consent at any time with future effect.

Furthermore, you have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The competent authority for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 27, 91522 Ansbach, Germany.

Data Protection Officer of Kaiyuan Information & Business GmbH