Privacyverklaring
Note: This is a convenience translation. In the event of discrepancies, the German version shall prevail.
Version: 1.1 As at: 8 October 2026
Privacy Policy for the LinkYourTicket website and app
Brief overview
We operate a booking platform for excursions and activities. To enable us to arrange your booking and issue your ticket, we process your name, email address, mobile number and the details of your booking. We do not see your card details – these are held exclusively by our payment service provider. Push notifications, location history, website analytics and promotional emails are only sent if you give your consent to each one individually. You can withdraw any of these consents at any time in your settings. You can disable app crash reports there at any time. Your booking data is usually automatically anonymised 60 days after the event. Further details are provided below.
1. Data controller
The data controller within the meaning of the General Data Protection Regulation is:
Frank Arlt,
14 B Bankstraße,
47441 Moers,
Germany
Telephone: +49 175 7413461
Email: <info@linkyourticket.com>
VAT registration number: DE461572575
We are not obliged to appoint a data protection officer. If you have any enquiries regarding data protection, please contact us at the email address given above, adding ‘Data Protection’ to the subject line.
We are not required to appoint a data protection officer under Article 27 of the GDPR, as we are established within the European Union.
2. General information and the scope of our offer
LinkYourTicket is a mobile and web-based booking platform for excursions, events and tourist activities. We act as an intermediary between excursion providers, resellers, tour guides and end customers; the organiser of the activity is always the respective provider, not us.
Our offering includes the website linkyourticket.com and the app for iOS and Android.
We process your data only to the extent necessary and for the purposes set out in this statement.
3. Your rights
You have the following rights in relation to your personal data held by us:
- Information pursuant to Article 15 of the GDPR. You can view your consent history in the settings under ‘Privacy and Consents’ and request a full data export.
- Rectification in accordance with Article 16 of the GDPR, directly via the account management section in the settings.
- Deletion in accordance with Article 17 of the GDPR. You can delete your account yourself in the settings; the deletion will take effect immediately. You can remove your location history separately by clicking the ‘Delete history’ button.
- Restriction of processing in accordance with Article 18 of the GDPR. Please contact us at the email address given above.
- Data portability under Article 20 of the GDPR. You will receive your data as a ZIP file via a download link, which is valid for seven days.
- Withdrawal of consent in accordance with Article 7(3) of the GDPR, at any time and without affecting the lawfulness of processing carried out prior to the withdrawal. You can find the individual toggles in the settings.
- Complaint to a supervisory authority in accordance with Article 77 of the GDPR. The competent authority for us is the State Commissioner for Data Protection and Freedom of Information in North Rhine-Westphalia, PO Box 20 04 44, 40102 Düsseldorf.
4. Right to object under Article 21 of the GDPR
You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data carried out on the basis of Article 6(1)(f) of the GDPR.
In our case, this applies to crash reports, server and access logs, the storage of profile pictures and event images, and the machine translation of catalogue texts. If you object, we will no longer process this data unless we can demonstrate compelling legitimate grounds for doing so which override your interests, rights and freedoms.
If your data is processed for the purposes of direct marketing, you have the right to object at any time without giving any reason. Once you have done so, we will no longer use your data for this purpose.
You can submit your objection informally to info@linkyourticket.com or use the relevant options in the settings.
5. Necessity of provision
You must provide your name, email address and mobile number in order to conclude and fulfil the booking contract; without this information, we cannot issue you with a ticket or send you a booking confirmation. You only need to provide your hotel of collection and room number if you require a hotel transfer. All other details are optional; failure to provide them has no consequences other than limiting the relevant function.
Suppliers, resellers and tour guides must also provide details of their business, as we require this information for invoicing and to fulfil our tax obligations.
6. No automated decision-making
Automated decision-making, including profiling as defined in Article 22 of the GDPR, does not take place as a matter of principle, and we do not create user profiles for advertising purposes. An exception to this is the check carried out to prevent misuse during registration and login in accordance with Section 17a: Registration via an anonymised connection or from a country in which we do not offer the platform will be automatically rejected. In this case, you can contact info@linkyourticket.com; we will then review your registration personally, and you will have the opportunity to explain your position.
7. Account, Registration and Security
Purpose: Identification, access control, account management.
Data: First name, surname, email address, mobile number, language, role, activation and verification codes, password (as a hash), access and renewal tokens. You may choose to save a profile picture. If you sign in via Apple or Google, we will store the relevant identifier.
Legal basis: Article 6(1)(b) of the GDPR.
Retention period: Until your account is deleted. Deletion is permanent. By default, the access token is valid for one hour and the refresh token for 30 days.
Security: Passwords are stored exclusively as hash values and never in plain text. All access is encrypted via HTTPS.
8. Booking, Ticket and Shopping Basket
Purpose: To record and process your booking, issue your ticket, liaise with the provider and handle cancellations.
Data: Name, email address, mobile number, hotel name, room number, pick-up time and pick-up status, ticket number, date, price and currency.
Shopping basket without an account: You’ll need an account to make a booking via the platform; however, you can fill your shopping basket beforehand. If a provider or local sales outlet makes a booking on your behalf, we store your email address, name and language directly in the booking record and not in a user account. For the shopping basket prior to registration, the app generates a pseudonymous device identifier, which we store alongside the pre-booked reservation. This serves solely to link your shopping basket to your device and to transfer the reservation to your account once you have logged in at a later date. Until the booking is made, there is no link to your real name; unpaid reservations expire automatically.
Legal basis: Article 6(1)(b) of the GDPR, including for the device identifier as a pre-contractual measure.
Recipient: The provider carrying out the activity receives the booking details, including your name and – in the case of a transfer – the hotel from which you are being collected, as they would otherwise be unable to provide the service.
Retention period: We automatically anonymise the personal data contained in your booking after a period set by the provider, which ranges from 14 to 120 days after the date of the booking. The default setting is 60 days. If you delete your account, the period runs from the date of deletion. The following details will be deleted: your name, your email address, your mobile number, pick-up hotel, room number and pick-up time, as well as the link to your account.
The following details are retained: the ticket number, the activity, the organiser, the date and time, the booking date, the number of participants, the check-in status, the amounts, the language and the tour guide or reseller who arranged the booking. In addition, the payment reference held by our payment service provider is retained. This allows the booking to be traced back to a specific person if necessary. We use this data set solely for refunds, invoicing and accounting purposes, as well as for aggregated analyses that do not identify individuals. The legal basis is Article 6(1)(c) of the GDPR in conjunction with Section 147 of the German Fiscal Code (AO) and Section 257 of the German Commercial Code (HGB). Once the statutory retention periods have expired – at the latest ten years after the end of the calendar year in which the booking was made – we delete the payment reference.
We are responsible, on behalf of the organiser, for ensuring compliance with the anonymisation period specified by the organiser and for sending notifications via the ‘Send collection time’ function. In this respect, the contract for data processing on behalf of the organiser, as set out in Annex 2 of the B2B Platform Terms of Use, applies.
9. Sharing a ticket via a public link
You can share your ticket. When you do so, we generate a time-limited, non-guessable link to a ticket document created on our server. Anyone with this link can access the ticket, including the ticket details and verification code, without having to log in – so please only share it with people you trust. The link in the app expires after seven days, whilst the download link in the booking confirmation expires after 180 days.
The legal basis is Article 6(1)(b) of the GDPR.
10. Payment processing
Service: Stripe Payments Europe Limited, The One Building, 1 Lower Grand Canal Street, Dublin 2, Ireland.
Purpose: To process your card payment for the ticket, as well as subscriptions for our business users and refunds in the event of cancellations.
Data held by us: customer ID, subscription ID, linked account ID, payment ID, commission amount, refund ID.
Data held by Stripe: Name, email address, postal address, card details or bank account details, VAT number, billing address, transaction history.
We do not store any card details or bank account information: Card details are collected directly by Stripe in the input field and stored by Stripe in accordance with the card industry’s security standards. If you tick the box to save your details in the payment section, Stripe will store your payment method in your customer account for future bookings; you can remove it from there at any time. The legal basis for this is Article 6(1)(a) of the GDPR.
Legal basis: Article 6(1)(b) of the GDPR and, insofar as Stripe verifies the identity of our suppliers, Article 6(1)(c) of the GDPR.
Third country: Stripe is an internationally operating provider. The processing of personal data may therefore also take place in third countries (in particular the USA). Data transfers to third countries are carried out only in accordance with Articles 44 et seq. of the GDPR, in particular on the basis of appropriate safeguards (e.g. standard contractual clauses) and the EU–US Data Privacy Framework (adequacy decision by the European Commission for certified US organisations). Stripe is certified under the EU–US Data Privacy Framework.
Retention period: Stripe typically retains transaction data for seven years in accordance with tax regulations.
11. Hosting, Databases and Protocols
Service: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Purpose: To operate our interface, store the database and maintain logs.
Place of processing: Exclusively within the European Union; the database, computing capacity and log storage are located in the Frankfurt area.
Data contained in the logs: time of access, path accessed, response status, response time and – for logged-in accesses – your user ID. The following are not logged: login details, cookies, IP address, payment signatures, passwords, tokens, email address, mobile number, as well as name, email address, mobile number, hotel and room number from bookings; these fields are completely removed before the log entry is written.
Legal basis: Article 6(1)(f) of the GDPR. Our legitimate interest lies in the technical operation of the system, in fault diagnosis and in preventing misuse and attacks.
Retention period: 90 days.
Transfer to third countries: Google is an international service provider. Personal data may therefore also be processed in third countries (in particular the USA). Data transfers to third countries take place only in accordance with Articles 44 et seq. of the GDPR, in particular on the basis of appropriate safeguards (e.g. standard contractual clauses) and the EU–US Data Privacy Framework (adequacy decision by the European Commission for certified US organisations). Google is certified under the EU–US Data Privacy Framework.
11a. Sending emails
We send booking confirmations, tickets, cancellations, collection times, account notifications and – with your consent – promotional emails via the Private Email service provided by Namecheap, Inc., 4600 East Washington Street, Suite 300, Phoenix, AZ 85034, USA. The data transferred includes your email address, your name and the content of the message. The legal basis is Article 6(1)(b) of the GDPR; for promotional emails, it is Article 6(1)(a) of the GDPR. Data is transferred to the USA on the basis of standard data protection clauses (Article 46(2)(c) of the GDPR). Sent messages are stored by the service provider for the periods customary for email inboxes.
12. File storage and image delivery
We store profile pictures and event photos in a data centre operated by Google Ireland Limited in the Frankfurt area, i.e. within the European Union. The legal basis for this is Article 6(1)(f) of the GDPR. Our legitimate interest lies in ensuring the reliable provision of these media files.
To ensure the rapid delivery of event images, profile pictures and company logos, we also use the ImageKit image network. The files are still hosted on our Google storage space. When an image is retrieved, your IP address is transmitted to ImageKit. The legal basis for this is Article 6(1)(f) of the GDPR; our legitimate interest lies in the rapid and reliable delivery of images.
13. Crash reports
Service: Functional Software, Inc., trading as Sentry, 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA.
Purpose: To monitor stability and limit errors.
Data: Technical error reports, a pseudonymous user ID and device details such as the operating system, application version and manufacturer. Any personal data in plain text is removed before transmission.
Scope of use: Only in the app and on our server, not on the website.
Legal basis: Article 6(1)(f) of the GDPR. Our legitimate interest lies in ensuring the stability of the application. You can disable this data transmission at any time in the settings under ‘Crash reports’.
Place of processing and third country: The data is stored on servers in Frankfurt and is therefore within the European Union. However, our contractual partner is based in the United States. Data transfers to third countries take place only in accordance with Articles 44 et seq. of the GDPR, in particular on the basis of appropriate safeguards (e.g. standard contractual clauses) and the EU–US Data Privacy Framework (adequacy decision by the European Commission for certified US organisations). Functional Software, Inc. is certified under the EU–US Data Privacy Framework.
Retention period: 90 days.
14. Push notifications
We send push notifications regarding your bookings, cancellations, changes to events and subscription-related matters. These notifications are only sent with your explicit consent in accordance with Article 6(1)(a) of the GDPR. You can withdraw your consent at any time via your settings. Without your consent, you will instead receive notifications essential to the contract by email.
Data: A pseudonymous delivery key of around 70 characters, as well as the content of the message.
Recipient and third country: Delivery is handled via the intermediary service provided by 650 Industries, Inc. (Expo), 624 University Ave, Suite 1, Palo Alto, CA 94301-2019, United States (USA) and, from there, via Apple Distribution International Limited, Cork, Ireland, for devices running iOS, or via the messaging service of Google Ireland Limited for devices running Android. The delivery infrastructure of both services operates globally, meaning that data is transferred to the United States; this is safeguarded in each case by standard data protection clauses.
Industries, Inc. (Expo) is an international provider. The processing of personal data may therefore also take place in third countries (in particular the USA). Data transfers to third countries are carried out only in accordance with Articles 44 et seq. of the GDPR, in particular on the basis of appropriate safeguards (e.g. standard contractual clauses) and the EU–US Data Privacy Framework (adequacy decision by the European Commission for certified US organisations). Industries, Inc. (Expo) is certified under the EU–US Data Privacy Framework.
Retention period: Until you withdraw your consent or your account is deleted; we remove entries that are no longer in use after 180 days. Messages remain with the messaging service only until they are delivered, and typically for less than an hour.
15th location
We use your location to show you events in your area. This only happens whilst you are searching and is not stored; the legal basis is Article 6(1)(b) of the GDPR, as it forms part of the core functionality.
Your locations – your location history – will only be stored permanently with your explicit consent in accordance with Article 6(1)(a) of the GDPR: The city, country, a location identifier and the formatted address will then be saved as your favourite. You can delete your history completely at any time in the settings.
Transfer to third parties: We use services provided by Google Ireland Limited to convert coordinates into location details and to suggest travel destinations. The coordinates and search terms are transferred, but not your account ID. Processing also takes place in the United States and is safeguarded by standard data protection clauses.
Google is a provider operating internationally. The processing of personal data may therefore also take place in third countries (in particular the USA). Data transfers to third countries are carried out only in accordance with Articles 44 et seq. of the GDPR, in particular on the basis of appropriate safeguards (e.g. standard contractual clauses) and the EU–US Data Privacy Framework (adequacy decision by the European Commission for certified US organisations). Google is certified under the EU–US Data Privacy Framework.
Map display: Maps are only loaded on the website once you have given your explicit consent; no connection is established with the map provider before this. In the app, we display meeting points, pick-up locations and hotels using your operating system’s map service: on iOS, Apple Maps provided by Apple Distribution International Limited, Cork, Ireland; on Android, Google Maps provided by Google Ireland Limited. In doing so, your IP address and the map section displayed are transmitted to the respective service. The legal basis for this is Article 6(1)(b) of the GDPR, as the display of the map forms part of the service you have booked.
16. Confirming your mobile number
To verify your mobile number, we will send you a one-off verification code via text message. We use Twilio Ireland Limited, 25–28 North Wall Quay, Dublin 1, Ireland, for this purpose. Your mobile number and the six-digit code will be transmitted. The legal basis for this is Article 6(1)(b) of the GDPR. The code will be deleted immediately after verification or once it has expired. Some of the processing is carried out by sub-processors in the United States, secured by standard data protection clauses.
17. Protection against automated retrieval
To protect against automated requests, we use the Cloudflare Turnstile service provided by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA.
Before the app displays an organiser’s telephone number or email address, we check whether the request has been made by a human. This is how we protect contact details from mass automated scraping. Company name, address, tax number and registration details can be accessed without this check.
The service analyses the technical specifications of your device and your application. It then decides whether a visual check is necessary. Usually, a single click is sufficient. Your IP address, these technical specifications and a verification key are transmitted.
We rely on Section 25(2)(2) of the TDDDG to access your device, as such access is strictly necessary for the secure provision of the contact details you have requested. Further processing is carried out in accordance with Article 6(1)(f) of the GDPR. Our legitimate interest is to protect our event organisers from unauthorised automated requests.
Cloudflare, Inc. is certified under the EU-US Data Privacy Framework. Data is transferred to the US on the basis of the European Commission’s adequacy decision (Article 45 of the GDPR).
We do not store the test result.
17a. Protection against misuse during registration and login
When you register and log in, we check your IP address using the proxycheck.io service (James Margetson, trading as proxycheck.io, 173 Cuckoo Hall Lane, London N9 8DT, United Kingdom). The service informs us whether the connection is routed via a proxy, a VPN or a data centre, and from which country it originates. We will reject any registration made via such a connection or from a country in which we do not offer the platform (see Section 6). When you register, we also store a risk indicator relating to your device, such as whether it has a camera and whether push notifications are enabled; this is used solely to detect abusive accounts. The legal basis is Article 6(1)(f) of the GDPR; our legitimate interest lies in protecting the platform, our users and event organisers from fraudulent accounts. For the United Kingdom, there is an adequacy decision by the European Commission (Article 45 of the GDPR). The service deletes unremarkable IP addresses after a few minutes and suspicious ones after 180 days.
18. Translation of event texts
We use the service provided by DeepL SE, Maarweg 165, 50825 Cologne, Germany, to machine-translate the event descriptions. Only the catalogue texts uploaded by the providers are transmitted; no personal data is transferred. The legal basis is Article 6(1)(f) of the GDPR; our legitimate interest lies in presenting our services in multiple languages. The processing takes place on servers in Frankfurt and therefore within the European Union. The transmitted texts are deleted immediately after translation.
18a. Suggested wording for organisers
When creating an event, organisers can receive suggested description texts. To this end, we transfer the event details entered by the organiser to Anthropic, PBC, 548 Market Street, San Francisco, CA 94104, USA. End-user data is not transferred. The legal basis is Article 6(1)(b) of the GDPR in relation to the organiser who accesses the function. The transfer to the USA is carried out on the basis of standard data protection clauses (Article 46(2)(c) of the GDPR).
19. Cookies and similar technologies
a) Principle
We use cookies on our website. In accordance with Section 25(2)(2) of the Telecommunications and Digital Services Data Protection Act, we do not require your consent for cookies that are strictly necessary for the service you have requested. For all other cookies and for our audience measurement, we will ask for your permission in advance. You can withdraw this permission at any time via the cookie settings at the bottom of the page.
We do not use cookies in the app. The selected language is stored in your device’s encrypted keystore.
b) Strictly necessary cookies
| Name | Purpose | Duration |
|---|---|---|
| lyt-lng | Save your chosen language | Session |
| lyt-token-customer, lyt-token-customer-refresh | Log in to the customer area | Log in or 30 days |
| lyt-token, lyt-token-refresh | Log in to the members’ area | Log in or 30 days |
| lyt-device | Anonymous device identifier for the shopping basket | 12 months |
| lyt-guest-favourites | Wishlist without an account | 12 months |
| lyt-place, lyt-region, lyt-tz | Location, region and time zone | 12 months |
| lyt-consent | Saving your cookie preference | 12 months |
| Lyt token provider | Organiser registration | Duration of access |
| lyt-token-provider-refresh | Renew this login | 30 days |
| lyt-share-banner-hidden | hidden notification banner | 90 days |
| lyt-sid | Session ID to record your cookie preference; with your consent, also used for audience measurement (point (c)) | Session |
| lyt-cart-discounts | discount codes redeemed in the shopping basket | 1 day |
The legal basis for the processing of the associated personal data is Article 6(1)(b) of the GDPR, insofar as it serves to fulfil the contract; in all other respects, it is Article 6(1)(f) of the GDPR, based on our legitimate interest in ensuring that our services function properly.
None of these cookies are used to create user profiles, and third parties do not have access to them.
c) Consent-based audience measurement
With your consent (Section 25(1) of the TDDDG in conjunction with Article 6(1)(a) of the GDPR), we store the following cookies in your browser so that we can show you the events you have most recently viewed and booked:
| Name | Purpose | Duration |
|---|---|---|
| lyt-viewed-events | Storing the events you have most recently viewed so they can be viewed again | 30 days |
| lyt-booked-events | Storing the events you have booked so they can be viewed again | 30 days |
In addition, with your consent, we track how our website is used – for example, which pages are visited and which steps are taken leading up to a booking. To do this, we store the pages visited and the steps taken on our server, together with the session ID from the ‘lyt-sid’ cookie and – if you are logged in – your user ID. We do not use any third-party services for this purpose. We delete the analytics data after 180 days. If you are logged in, we also store the most recently viewed events in your account so that we can display them to you again; these are deleted after 90 days.
These cookies are not technically necessary for the platform to function; the core functions remain fully available to you even without them. You can withdraw your consent at any time with future effect via the cookie settings. If you withdraw your consent, the relevant cookies will be deleted immediately.
Please note: As a technical alternative, this information may also be stored on the server side in your user account, provided you are logged in; in this case, there is no access to your device within the meaning of Section 25(1) of the TDDDG.
d) Evidence of your decision
For the purposes of providing evidence in accordance with Article 7(1) of the GDPR, we store the time, your selection, the version of the consent text and your IP address on our server.
In addition, we store the browser identifier and the session identifier. The retention period for this data is set out in Section 23.
e) Services not used
We do not use Google Analytics, not Tag Manager, not the Facebook Pixel, not the TikTok Pixel, not Hotjar, not PostHog and not Mixpanel. We do not use any advertising or affiliate services. We host the fonts for our website and app ourselves; no connection to third-party servers is established for this purpose. In the payment field of our payment service provider, a font is currently loaded from servers operated by Google Ireland Limited. In doing so, your IP address is transmitted to Google.
20. Registration via third-party providers
You can log in using your Google account or your Apple ID. Google or Apple will then provide us with your name and email address; with Apple, you can choose a redirected address instead of your email address. We also store your account ID with the provider so that we can recognise you the next time you log in. The legal basis for this is Article 6(1)(b) of the GDPR, as logging in serves the purpose of providing access to your account. Use of this feature is voluntary. You can also log in using your email address and password.
21. When we do not receive data directly from you
In three cases, we do not receive data about you from you, but from third parties. We are informing you of this in accordance with Article 14 of the GDPR:
- Booking via a tour guide or a sales outlet: If you do not book via the app yourself, but via a tour guide or a high-street sales outlet, we will receive your name, email address, mobile number and booking details from them. The source is the relevant tour guide or sales outlet. The purpose, legal basis, recipients and retention period are as set out in Section 8.
- Login via a third-party provider: The source is the relevant login service; see section 20.
- Payment processing: We receive updates from our payment service provider regarding payment status, refunds and chargebacks. The source is Stripe.
22. Marketing emails and reactivation
We will only send you promotional emails with your express consent. You can withdraw your consent at any time via your settings. Even without your consent, you will continue to receive all messages essential to the contract, such as booking confirmations, cancellations and password resets.
If business users delete their account, they may also give separate consent for us to retain their email address, first name and language setting for the purposes of reactivation. This consent is voluntary and is not a condition of deletion. The legal basis is Article 6(1)(a) of the GDPR and Section 7(2)(3) of the UWG. For record-keeping purposes, we store the version of the consent text, the IP address, the browser identifier and the time stamp. The data will be automatically and permanently deleted six months after consent is given; logging out results in immediate and permanent deletion.
23. Overview of retention periods
| Data category | Deadline |
|---|---|
| Account details | until account closure |
| Password hash | until the account is deleted or the password is changed |
| Access token | one hour by default |
| Renewal token | 30 days by default |
| Booking details | 60 days after the date, 14–120 (configurable) |
| Invoices/tax-relevant documents | up to ten years (Section 147 of the German Fiscal Code (AO), Section 257 of the German Commercial Code (HGB)) |
| Delivery key for push notifications | until further notice, inactive after 180 days |
| Location history | until further notice or deletion |
| Ticket sharing link | 7 or 180 days |
| Data export download link | seven days |
| Server and access logs | 90 days |
| Crash reports | 90 days |
| Messages read | 7 days after the date of reading (14 days for messages relating to bookings or subscriptions) |
| Unread messages | 365 days |
| Proof of consent to the use of cookies | three years |
| Audience measurement (website) | 180 days |
| Recently viewed events (account) | 90 days |
| Suspicious IP addresses on proxycheck.io | 180 days |
| Reactivation list | six months |
| Verification code for mobile number | immediately after verification |
| Translated texts | 0 days |
| Payment reference and accounting documents (pseudonymised) | 10 years from the end of the calendar year in which the entry was made (Section 147 of the German Fiscal Code (AO), Section 257 of the German Commercial Code (HGB)) |
24. Safety
We protect your data by, amongst other things, using encrypted transmission via HTTPS with at least TLS 1.2, encryption of the database at rest, daily backups with the option to restore data, access control at all interfaces, authorisation checks for every access to third-party data records, removal of personal data fields before each log entry, and automatic anonymisation of transaction data once the retention period has expired.
25. Amendments to this statement
We keep this policy up to date. In the event of significant changes – such as new processing purposes, new service providers or changes to retention periods – we will notify you the next time you use the service. You can view the current version and all previous versions in the settings under ‘Privacy and Consents’.