Privacy Policy
1. Controller
The controller responsible for data processing on this website within the meaning of the EU General Data Protection Regulation (GDPR) is:
firstclass holidays GmbH, Leo-Graetz-Str. 16, 81379 Munich, Germany
Phone: +49 89 370 143 40, Email: info@firstclass-holidays.org
2. General information
We take the protection of your personal data seriously and process it only in accordance with the GDPR and applicable data protection law. This policy explains what data we collect when you use this website, why, and what rights you have.
3. Hosting and server log files
This website is built and hosted with Lovable, a service of Lovable Labs AB, Regeringsgatan 25, 111 53 Stockholm, Sweden. The website's backend functions (enquiry form) run on infrastructure provided by Supabase, Inc., 970 Toa Payoh North #07-04, Singapore 318992, in an EU data center. When you visit the website, technical information that your browser transmits is processed automatically, such as IP address, date and time of access, pages visited, referrer URL, browser type and operating system. This is necessary to deliver the website securely and reliably. The legal basis is Art. 6 (1) (f) GDPR (our legitimate interest in the secure and stable operation of the website). We have concluded a data processing agreement with Lovable.
The following technically necessary cookies and storage entries are used: __cf_bm (cookie set by Cloudflare for bot protection, stored for about 30 minutes); __dpl (cookie that routes your request to the current version of the website, stored for about 24 hours); vg-consent (entry in your browser's local storage that saves your cookie choice for 12 months).
Lovable also measures the technical performance of the website anonymously, for example page load times. No cookies are used for this. The legal basis is Art. 6 (1) (f) GDPR (our legitimate interest in a fast and reliable website).
4. Cookies and consent
We use cookies and similar technologies (such as local storage). Technically necessary storage, such as saving your consent choice, is used on the basis of § 25 (2) of the German Telecommunications Digital Services Data Protection Act (TDDDG) and Art. 6 (1) (f) GDPR. All other cookies and tools (currently only external media) are only used with your consent pursuant to § 25 (1) TDDDG and Art. 6 (1) (a) GDPR. When you first visit the website, you can choose which categories to allow. You can change or withdraw your consent at any time via "Cookie settings" in the footer; withdrawal does not affect the lawfulness of processing carried out before it.
5. Enquiry form and contact by email
When you send us an enquiry via the form or by email, we process the information you provide (such as name, email address, phone number, travel dates, number of guests, services of interest and your message) in order to answer your enquiry and prepare an offer. The legal basis is Art. 6 (1) (b) GDPR (pre-contractual measures at your request) and, for general enquiries, Art. 6 (1) (f) GDPR (our legitimate interest in answering your request). Form submissions are transmitted to us by email via Lovable Labs AB, Regeringsgatan 25, 111 53 Stockholm, Sweden, with which we have concluded a data processing agreement. Enquiries are also stored in our database (Lovable Cloud, on servers in the EU). Only authorised team members can access them, including our internal notes on how we followed up. We delete your data once it is no longer needed for these purposes, unless statutory retention obligations apply (in particular under commercial and tax law). If your enquiry leads to a booking, your data is processed further to perform the contract.
6. Interactive map (external media, only with consent)
On the Gargnano page, you can choose to load an interactive map based on OpenStreetMap, provided by the OpenStreetMap Foundation, St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom. The map is only loaded after you consent. When it loads, your IP address and technical browser data are transmitted to the map server. The United Kingdom has an adequacy decision of the European Commission. The legal basis is your consent (Art. 6 (1) (a) GDPR). The map on our home page is part of our own website and does not connect to any external service.
7. Fonts
The fonts used on this website are hosted on our own servers. No connection to external font providers is made.
8. Transfers to third countries
Where service providers process data outside the European Union or the European Economic Area, this takes place only where an adequate level of data protection is ensured, for example on the basis of an adequacy decision of the European Commission (such as the EU-U.S. Data Privacy Framework) or EU standard contractual clauses.
9. Your rights
You have the right to access your personal data (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Where processing is based on your consent, you may withdraw your consent at any time with effect for the future. To exercise your rights, contact us at info@firstclass-holidays.org.
10. Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany.
11. Data security
This website uses SSL/TLS encryption to protect the transmission of data, which you can recognize by "https" in your browser's address bar.
12. Changes to this policy
We may update this privacy policy to reflect changes to our website or legal requirements. The current version is always available on this page.
Last updated: 15 October 2026