LEGAL INFORMATION

Privacy

Updated 13.11.2026

This privacy notice explains how we process personal data when you visit Expiriland’s information pages for visitors and prospective partners, or contact us. It also covers the associated legal pages.

1. Who is responsible for your data

The controller is Andrii Marzhanianu, a sole proprietor trading as Expiriland, Innstraße 52, 83022 Rosenheim, Germany.

For privacy questions or to exercise your rights, contact info@expiriland.com or call +49 162 6719435.

2. What these pages offer

These pages introduce Expiriland and the opportunity to work with us. Purchases, payments, bookings, customer accounts and voucher redemption are not available on these information pages.

You can contact us by email or phone. Once the partner enquiry form opens, you will also be able to use it to get in touch. While it is closed, no enquiries are sent or stored through it. The information below about form processing applies from the point when the form opens. Visiting the site or contacting us does not subscribe you to a newsletter.

3. Website access and hosting

When you visit the website, our server processes technical information including your IP address, the date and time, the requested address, HTTP method and status, the amount of data transferred, browser information supplied by your browser and, where provided, the referring page. Error and security logs may contain details of the technical event concerned.

We use this information to deliver the pages, keep the site secure and reliable, and investigate errors or misuse. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is in the functionality and security of this information service.

Our hosting provider is Hostinger International Ltd., 61 Lordou Vironos Street, Larnaca 6023, Cyprus. The website runs on a virtual server in Frankfurt am Main, Germany. Automatic server backups are created weekly and stored in Lithuania. Hostinger acts as a processor for the hosting services we engage it to provide.

Access and error logs on the front-end web server are rotated weekly. Up to four archived access logs and ten archived error logs are retained in addition to the current files. This describes a rotation cycle rather than a fixed deletion period measured in days.

We use application logs to investigate and resolve technical problems and handle specific security incidents. Once a problem has been resolved or an incident investigation is complete, we review the related entries and delete those that are not needed for another specific technical problem or security incident. Section 9 explains how we handle records that must be retained by law or are needed in connection with specific legal claims.

4. Cookies, language and our own content

While the partner enquiry form is closed, these information pages do not set new session or XSRF cookies. Your chosen language is preserved through the locale parameter in links. An expiriland_locale language cookie left over from an earlier visit may be read once and is then deleted. This supports the language display you requested. The legal bases are section 25(2)(2) TDDDG and Article 6(1)(f) GDPR, reflecting our interest in displaying the site in the appropriate language.

When the partner enquiry form is enabled, the website uses the expiriland_prod_session session cookie and the XSRF-TOKEN security cookie. They link related requests and protect form submissions. The session cookie contains a technical session identifier. The session and its cookies are configured to remain valid for 120 minutes after the last activity, with that period renewed when activity continues. The legal bases for these necessary cookies are section 25(2)(2) TDDDG and Article 6(1)(f) GDPR. Our legitimate interest is in providing a secure and reliable form.

The associated session data is stored on our server. It may include the language, security and submission identifiers, and feedback on form processing. If there are input errors, the entered information may be held temporarily in the session so it can be shown again. Once its validity period has expired, the session can no longer be used. Expired server-side session files are removed during technical storage cleanup. The end of session validity therefore does not specify the exact day or minute of physical deletion.

If you make a privacy choice, we store that decision, its version and the time in the expiriland_prelaunch_consent cookie for up to 180 days. It contains no separate visitor ID. This lets us respect your choice on later visits. The legal bases are section 25(2)(2) TDDDG and Article 6(1)(f) GDPR. Our legitimate interest is in reliably applying your privacy settings. You can change your choice at any time through “Cookie settings”.

Images, font files and stylesheets are loaded from our own website. Local system fonts may also be used. These information pages do not embed external maps, videos, social media content or advertising trackers.

5. Google Analytics 4

We plan to use Google Analytics 4 to analyse how these information pages are used. The service is currently disabled: no analytics data is sent to Google and no analytics cookies are set. The information below describes the planned use after activation. Even then, data will only be collected with your consent.

We intend to engage Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to process analytics data on our behalf under Article 28 GDPR. This processing will be governed by Google’s data processing terms linked below.

We want to understand which information pages people visit and how they use our site so we can improve its content, clarity and technical presentation. Processing will include the page visited and its title, time and session details, language, the referring website, device, browser and operating system information, approximate location data, and pseudonymous cookie and session identifiers.

The planned integration will not send names, email addresses, phone numbers or the contents of your partner enquiry to Google Analytics. We do not plan to use Google Signals, personalised advertising, a link to Google Ads or our own User-ID to associate activity. Enhanced Measurement will be disabled before activation.

Connecting to Google involves technical processing of your IP address. According to Google, for visits from the EU, Switzerland and the United Kingdom, IP addresses are used in those regions to derive approximate location data and then discarded before being logged or stored. Further analysis uses pseudonymous identifiers, so this handling of IP addresses alone does not make the analysis anonymous.

The legal basis for analytics is your consent under Article 6(1)(a) GDPR. Storing and reading analytics cookies is subject to section 25(1) TDDDG. Consent is voluntary. The planned integration loads the Google tag only after your explicit agreement. If you decline, the Google tag is not loaded and no cookieless measurement requests are sent to Google either. You can use these information pages without analytics.

If you consent, the planned integration will use the first-party cookies expiriland_prelaunch_ga and expiriland_prelaunch_ga_* to recognise a browser and associate visits with sessions. Their configured lifetime is no more than 180 days from creation and is not extended by later visits. Browsers may impose shorter limits. If you withdraw consent, our integration removes these analytics cookies.

We plan to set a two-month retention period for user-level and event-level data in the GA4 property before launch. The option to extend retention of user identifiers when new activity occurs will be disabled. We will apply and verify these settings before activation; they describe the intended operation of the service, which is currently disabled.

Google deletes data that has reached its configured retention period in a monthly deletion cycle. This retention setting does not cover standard aggregated reports, which may remain available for longer. The lifetime of cookies in your browser and the retention of data by Google are separate processes.

You can withdraw your consent at any time through “Cookie settings”, with effect for the future. We will then stop further analytics collection through this integration and remove the associated analytics cookies. Withdrawal does not automatically delete data already sent to Google from Google’s systems. It does not affect the lawfulness of processing before withdrawal, and your rights of access, erasure and other data protection rights remain unchanged.

Data may also be processed outside the European Economic Area, in particular by Google LLC in the United States. Google LLC is certified under the EU-US Data Privacy Framework. Transfers to certified recipients in the United States are covered by a European Commission adequacy decision under Article 45 GDPR. For transfers not covered by an adequacy decision, Google’s contractual terms provide, in particular, for standard contractual clauses under Article 46(2)(c) GDPR. Information about these safeguards is available in the Google terms linked below; you can also request a copy from info@expiriland.com.

6. Partner enquiries through the form

Once the partner enquiry form is enabled, you can use it to send us a non-binding enquiry about working together. We need your name, email address and a message. Providing a phone number is optional. We use this information to review your enquiry, reply and discuss a possible partnership with you.

The enquiry is stored in our database. An email notification containing the submitted information is also planned to be sent to info@expiriland.com for handling the enquiry. We also store the chosen language, receipt and processing times, a technical identifier to prevent duplicate submissions, the notification status, the version of this privacy notice, and the time and wording of your acknowledgement of it.

If your enquiry concerns a contract with you or steps you request before entering into one, the necessary processing is based on Article 6(1)(b) GDPR. Other enquiries and communication with a company’s contact persons are covered by Article 6(1)(f) GDPR. Our legitimate interest is in handling partnership enquiries and communicating with the relevant people. Your acknowledgement documents that the information about processing was provided to you and that you have taken note of it.

To protect against bulk or abusive submissions, we limit the number of form requests. For this purpose, a technical identifier derived from the IP address and a short-lived request counter are processed on the server. The limit operates within a one-minute window. Expired cache entries are physically removed during storage cleanup. The legal basis is Article 6(1)(f) GDPR, reflecting our legitimate interest in protecting the form.

Once we have fully dealt with your enquiry and completed any agreed follow-up, we delete the enquiry, related processing records and notifications. If we begin working together, we use the information needed to prepare, perform and complete the contract. If discussions do not continue, we check whether any specific next steps have been agreed and are still being pursued. Section 9 explains how we handle records that must be retained by law or are needed in connection with specific legal claims.

7. Contact by email and phone

If you write to us, we process your email address, message contents and any other information you provide so that we can deal with your enquiry and reply. When you call, we process the information you give us and, where transmitted, your phone number for the conversation or a callback you request. We may take notes where needed. Please only share information relevant to your enquiry.

For info@expiriland.com, we use Hostinger Mail from Hostinger International Ltd., 61 Lordou Vironos Street, Larnaca 6023, Cyprus. According to the provider, mailbox data and its backups are stored in France and Germany. Processing also covers the connection data and metadata needed for delivery, spam protection and security. Hostinger acts as a processor for the email services we engage it to provide.

If your enquiry concerns a contract with you or steps you request before entering into one, the necessary processing is based on Article 6(1)(b) GDPR. Other enquiries and communication with a company’s contact persons are covered by Article 6(1)(f) GDPR. Our legitimate interest is in dealing with and responding to the subject of your enquiry.

We delete your message and the related information, including any necessary notes of conversations, once your enquiry has been fully dealt with and no agreed follow-up questions or further steps remain outstanding. If we continue communicating as part of a partnership, we use the information needed for the relevant contractual purpose. Section 9 explains how we handle records that must be retained by law or are needed in connection with specific legal claims.

According to Hostinger, messages in Spam and Trash are automatically deleted after 30 days. This period does not apply to the inbox, other retained correspondence or the provider’s backups.

8. Recipients and international processing

Access is granted to the proprietor, authorised people responsible for operating the site or handling enquiries, and the hosting and email providers we use, insofar as they need it to perform their tasks. Processing on our behalf is subject to Article 28 GDPR. We disclose data to authorities or other recipients only where a legal basis permits or requires it. These information pages do not transmit purchase or booking data to experience providers. If Analytics is enabled and you consent to it, Google also receives the data described in section 5.

The Hostinger locations listed above for website hosting and email storage are in the European Economic Area. Hostinger also uses affiliated companies and subprocessors. Support and individual services may involve processing outside the EEA. The server location alone therefore does not mean that all processing takes place in Europe.

For relevant transfers to third countries, Hostinger’s data processing agreement provides, in particular, for the European Commission’s standard contractual clauses under Article 46(2)(c) GDPR. The agreement and information about subprocessors are available through the Hostinger data processing link below. You can also ask info@expiriland.com for information about the safeguards applicable to your data and a copy of them.

Processing on our behalf for VPS and email services is governed by Hostinger’s Data Processing Addendum (DPA), which forms part of its contractual terms.

9. Retention and backups

When a matter is closed, we review which records still need to be kept. Statutory retention duties depend on the content of each record. Where those duties apply, the statutory periods are generally six years for business correspondence, eight years for accounting vouchers and ten years for certain accounting records. The period generally starts at the end of the relevant calendar year. The legal basis is Article 6(1)(c) GDPR together with the applicable rules, in particular section 147 AO and, where applicable, section 257 HGB. These periods do not apply indiscriminately to all enquiry or website data.

If particular records are needed for an actual legal dispute or to establish, exercise or defend specific, foreseeable legal claims, we retain them for that purpose. Once the matter has been finally resolved, we review whether there is any remaining need to keep them and delete them as soon as that need ends. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is in protecting and enforcing our rights.

Hostinger backs up our virtual server weekly and stores the backups in Lithuania. Two weekly restore points are retained, with new backups replacing older ones. Data deleted from the live system may remain in a backup until that restore point is replaced. Backups are used to restore data after a loss. When restoring a backup, we take account of any deletions made since it was created.

We also back up the application database and files in the application’s public storage daily on the same virtual server in Frankfurt am Main, Germany. We retain no more than 14 daily restore points, with new backups replacing the oldest ones. These copies are used solely to restore data after a loss. Deleted data may remain in these copies until the relevant restore point is replaced; if we restore a copy, we reapply any deletions made since it was created.

Once a technical change and its functional checks are complete, we review whether any additional database copies made beforehand are still needed to restore the previous state. We delete those copies as soon as they are no longer needed for that purpose.

Email backups follow Hostinger’s technical backup and recovery cycle. Messages deleted from the mailbox may remain in a backup until that backup is replaced or removed. Hostinger does not publish a general fixed maximum retention period for these backups. They are used for recovery; we do not use them for the day-to-day handling of enquiries.

10. Your rights

Subject to the applicable legal conditions, you have the right to access and receive a copy of your personal data, and to request rectification, erasure or restriction of processing. Data portability applies where processing is based on consent or a contract and is carried out by automated means. Statutory retention obligations may prevent immediate erasure.

You can withdraw consent at any time with effect for the future. This does not affect the lawfulness of processing carried out before withdrawal. To exercise your rights, contact info@expiriland.com. We generally respond within one month in accordance with Articles 12 to 22 GDPR.

11. Your right to object

You may object at any time to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation. We will then stop processing the data concerned unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims. You can object to direct marketing at any time without giving such grounds. Contact info@expiriland.com to do so.

12. Complaints to a supervisory authority

You can complain to a data protection supervisory authority, particularly in the member state of your habitual residence, workplace or the place of the suspected infringement. You do not have to contact us first.

The supervisory authority for our business in Bavaria is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany. Contact options are available at https://www.lda.bayern.de/de/kontakt.html. You also retain the right to complain to another competent supervisory authority.

13. Providing data and updates

Contacting us is voluntary. To reply, we need a suitable means of contacting you and enough information to deal with your enquiry. We cannot deliver the website without the technically necessary connection data. We do not carry out automated decision-making, including profiling, within the meaning of Article 22 GDPR.

We update this notice when the site’s features or the services we use change. Optional analytics is used only with your consent. We inform you about changes to its processing before they take effect.