Privacy notice

Controller

The controller within the meaning of the GDPR is:
Seitenhafen361, sole proprietorship (Einzelunternehmen)
Owner: Schayan Yousefian
Freienwalder Str. 34
13359 Berlin
Deutschland

There is no statutory requirement to appoint a data protection officer.

Hosting and server logs

The site is hosted as static files on Cloudflare Pages. The provider is Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA; for Europe, Cloudflare Germany GmbH, Rosental 7, 80331 Munich.

When a page is requested, Cloudflare processes technically necessary access data: the IP address, the date and time, the address requested, the volume transferred, the browser type and the operating system. This processing is necessary to deliver the site and keep it secure.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure and reliable provision of the website.

We also use Cloudflare Web Analytics, a cookieless audience measurement service from Cloudflare. Each page loads a small script from static.cloudflareinsights.com that records the page view, referrer, browser and device type, approximate country, and technical page-load and performance metrics, and sends them to this site's /cdn-cgi/rum endpoint, which is operated by Cloudflare. Cloudflare states that Web Analytics sets no cookies, does not use local storage, does not fingerprint visitors and builds no user profiles; we only receive aggregated statistics. When the script loads, Cloudflare receives technical request data such as your IP address. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is privacy-friendly measurement of the site's reach and loading performance.

Processing in the United States cannot be excluded. Cloudflare is certified under the EU-US Data Privacy Framework, supplemented by standard contractual clauses under Art. 46(2)(c) GDPR. We have concluded a data processing agreement with Cloudflare under Art. 28 GDPR.

We operate no database and no server-side application of our own. There are no forms, no sign-in and no newsletter.

Analytics and external content

BestTimeToHike sets no advertising cookies. Google Analytics, and with it its cookies, runs only after you press “Accept” in the cookie banner (see the section on Google Analytics 4). Without consent, the only audience measurement is the cookieless Cloudflare Web Analytics described above. We create no user profiles.

Fonts and destination photographs are served from our own domain. The GetYourGuide integration analyzer loads on every page; on eligible destination and month pages, embedded activity cards are supplied by GetYourGuide and Viator. Your browser therefore connects to widget.getyourguide.com and www.viator.com and transmits technically necessary connection data such as your IP address, the requested page, browser information and the time of access. These providers may process this data and use browser storage under their own privacy notices.

GetYourGuide Integration Analyzer

Every page loads the GetYourGuide Integration Analyzer from widget.getyourguide.com. It enables technical monitoring and performance measurement of our labelled GetYourGuide links and activity cards. Data sent to GetYourGuide may include the IP address, browser and device information, the page viewed, the referrer, and interactions with these links. The Analyzer also retrieves a pseudonymous visitor identifier from widget.getyourguide.com and sends event data to collector.getyourguide.com.

For this it stores on your device, under this site's domain, the cookie “session_id” (a session cookie deleted when you close the browser), the sessionStorage entry “gyg_visitor_id” (until you close the tab) and the localStorage entry “partner_id” containing our partner ID (until you clear your browser data). GetYourGuide states that no third-party GetYourGuide cookies are set.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is operating, checking and measuring the affiliate integrations. You can object to this processing under Art. 21 GDPR, and you can delete the stored entries at any time by clearing this site's data in your browser.

Audience measurement with Google Analytics 4

With your consent we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). The purpose is audience measurement: we want to know how many people visit the site, which pages they read and how they arrive, so that we can improve the content.

Google Analytics is loaded only after you press “Accept” in the cookie banner. Until then, and if you decline, no script is loaded from Google and no data is sent to Google. We use Google Consent Mode v2: every storage and advertising signal starts as denied, and your consent grants analytics storage only. Advertising features, Google signals and ad personalisation are switched off.

When Google Analytics runs, it processes usage data such as the pages visited, time and duration of the visit, the referring page, your approximate location derived from your IP address, and technical information about your browser and device. Google shortens IP addresses within the EU and does not store them in full. We do not merge this data with other data.

Cookies set: “_ga”, to distinguish visitors, and “_ga_<ID>”, to keep the session state. Both expire after 2 years unless you delete them or withdraw your consent.

Google Analytics data is retained for 14 months and then deleted automatically.

The legal basis is your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG (formerly TTDSG).

Data may be transferred to Google LLC in the United States. Google LLC is certified under the EU-US Data Privacy Framework, on the basis of the European Commission's adequacy decision of 10 July 2023. We have concluded a data processing agreement with Google under Art. 28 GDPR.

You can withdraw your consent at any time with effect for the future, via the “Cookie settings” link in the footer of every page. On withdrawal, Google Analytics is switched off for your browser and the Google Analytics cookies are deleted. The lawfulness of processing before the withdrawal is not affected.

Your choice in the cookie banner is stored in your browser's local storage under the key 'bth.consent.v1', so that the banner does not reappear on every page. This storage is strictly necessary to respect your choice and requires no consent under § 25(2) no. 2 TDDDG.

Your shortlist, stored on your device

When you star a destination, that list is stored in your browser's local storage under the key 'bth.saved.v1'. This is not cookie technology, but it falls under § 25 TDDDG all the same.

It is stored solely to provide the service you explicitly asked for and is strictly necessary for it, so no consent is required under § 25(2) no. 2 TDDDG.

The list never leaves your device. It is not transmitted to us or to anyone else, because there is no recipient for it. You can delete it at any time by clearing site data in your browser.

Contacting us by email

If you write to us, we process what you send solely in order to deal with your enquiry. The legal basis is Art. 6(1)(f) GDPR, or Art. 6(1)(b) where a contract is being initiated or performed.

We delete this data once the enquiry has been dealt with, unless statutory retention obligations apply.

Advertising and affiliate links

This site may contain clearly labelled affiliate links to Booking.com, GetYourGuide and Viator. If you follow one of these links and make a booking, we may receive a commission at no extra cost to you.

GetYourGuide and Viator activity cards are loaded on eligible destination and month pages through the embedded widgets described above. Booking.com is contacted only after you actively click a labelled link; static internal forwarding pages are also used for the separate partner buttons. Each partner may use cookies, browser storage or click identifiers under its own privacy notice.

The order of destinations and rankings is calculated solely from the published climate data and scoring rules. Commercial interests do not influence it, and that commitment is recorded as an invariant checked by the project's architecture guard.

We do not create personal profiles from affiliate clicks and receive only partner reports or settlement information made available through the respective programme. The internal forwarding pages are not indexed by search engines.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing (Art. 21 GDPR).

You also have the right to lodge a complaint with a supervisory authority. The competent authority for us is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59-61, 10555 Berlin.

Changes to this notice

We update this notice whenever the technical implementation of the site or the legal position changes. The version published here is always the applicable one.