Privacy & Policy
Last updated: 23 June 2026
This Privacy Policy explains how TripProfits collects, uses, stores, and protects personal data when you visit or use our website and platform.
TripProfits is a digital platform for discovering, organizing, and booking experiences offered by independent organizers. TripProfits provides the technical platform, booking tools, and community infrastructure. The experiences listed on the platform are offered and carried out by the respective independent organizers.
1. Controller
The controller responsible for data processing on this website is:
Mehdi Aljebaay
Wilhelmsruher Damm 139
13439 Berlin
Germany
E-mail: admin@tripprofits.com
The controller is the natural or legal person who determines the purposes and means of processing personal data.
2. General information on data protection
We take the protection of your personal data seriously. Personal data means any information that can identify you directly or indirectly, such as your name, e-mail address, IP address, account data, booking data, communication data, payment-related information, or technical usage data.
We process personal data only where there is a legal basis under the General Data Protection Regulation (GDPR), especially where processing is necessary to provide the website, create and manage user accounts, process bookings, communicate with users, operate organizer tools, provide referral features, fulfill contractual obligations, comply with legal obligations, or protect legitimate business interests.
3. Hosting
This website is hosted by:
Hostinger International Ltd.
61 Lordou Vironos Street
6023 Larnaca
Cyprus
When you visit this website, personal data may be processed on the servers of our hosting provider. This may include IP addresses, server log files, technical metadata, contact data, account data, booking data, and other data generated through the use of the website.
Hosting is used to provide a secure, stable, and efficient online service. The legal basis is Art. 6(1)(f) GDPR. Where processing is necessary for the performance of a contract or pre-contractual measures, the legal basis is Art. 6(1)(b) GDPR.
We have concluded a data processing agreement with our hosting provider where required under Art. 28 GDPR.
4. Server log files
When you access this website, the hosting provider automatically collects and stores technical information in server log files. This may include:
- IP address
- Date and time of access
- Requested URL or file
- Referrer URL
- Browser type and version
- Operating system
- HTTP status code
- Amount of data transferred
This data is processed to ensure the technical operation, security, and stability of the website. The legal basis is Art. 6(1)(f) GDPR.
5. Cookies and similar technologies
TripProfits uses cookies and similar technologies to provide essential website functions, maintain sessions, secure the platform, remember user settings, prevent misuse, and provide platform features.
Technically necessary cookies are used on the basis of Art. 6(1)(f) GDPR and, where applicable, because they are strictly necessary to provide a digital service requested by the user.
Non-essential cookies and similar technologies, such as analytics, marketing, social media, tracking, embedded third-party content, Google Maps, reCAPTCHA, or social plugins, are used only where legally permitted and, where required, only after you have given your consent. The legal basis is Art. 6(1)(a) GDPR and § 25 TDDDG. You may withdraw your consent at any time with effect for the future.
If TripProfits uses a cookie consent banner, you can manage your preferences through that banner.
6. Contact by e-mail or contact form
If you contact us by e-mail or through a contact form, we process the information you provide in order to handle your request. This may include your name, e-mail address, message content, and any additional information you voluntarily provide.
If your request relates to a contract or pre-contractual measures, the legal basis is Art. 6(1)(b) GDPR. In other cases, the legal basis is our legitimate interest in responding to requests and managing communication, Art. 6(1)(f) GDPR. If consent is requested, the legal basis is Art. 6(1)(a) GDPR.
7. User accounts and registration
Users may create an account on TripProfits. During registration and account use, we may process data such as:
- Name
- E-mail address
- Password or authentication data
- Account role, such as organizer or traveller
- Profile information voluntarily provided by the user
- Login, device, and security data
This data is processed to create, manage, secure, and provide the user account and related platform functions. The legal basis is Art. 6(1)(b) GDPR.
We may also process account data to prevent misuse, protect the platform, and maintain technical security. The legal basis is Art. 6(1)(f) GDPR.
8. Registration and login with Facebook Connect
TripProfits may allow users to register or log in using Facebook Connect. The provider is:
Meta Platforms Ireland Limited
Merrion Road
Dublin 4, D04 X2K5
Ireland
If you use Facebook Connect, you will be redirected to Facebook or a Facebook login interface. Facebook may confirm your identity to TripProfits and may provide us with account data such as your name, e-mail address, profile ID, profile image, or other data you have approved through your Facebook settings.
The purpose is to provide a convenient registration and login option. The legal basis is your consent, Art. 6(1)(a) GDPR. You may revoke your consent with effect for the future.
Further information is available in Meta’s privacy information: https://www.facebook.com/privacy/policy/
9. Registration and login with Google
TripProfits may allow users to register or log in using Google. The provider is:
Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland
If you use Google login, Google may confirm your identity to TripProfits and may provide us with account data such as your name, e-mail address, profile ID, profile image, or other data you have approved through your Google account settings.
The purpose is to provide a convenient registration and login option. The legal basis is Art. 6(1)(a) GDPR where consent is requested, or Art. 6(1)(f) GDPR based on our legitimate interest in providing a user-friendly login process.
Further information is available in Google’s privacy policy: https://policies.google.com/privacy
10. Organizer accounts and experience offers
Independent organizers may use TripProfits to create and publish experience offers. In this context, we may process:
- Organizer name and contact details
- Business or profile information
- Experience descriptions, prices, dates, locations, and availability
- Booking and participant information necessary to manage the experience
- Communication related to offers, bookings, cancellations, or support requests
This data is processed to provide organizer tools, publish offers, manage bookings, and support the contractual relationship between TripProfits, organizers, and users. The legal basis is Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR.
11. Traveller bookings
When travellers book or request to join an experience through TripProfits, we may process:
- Name and contact details
- Booking details
- Selected experience and date
- Number of participants
- Messages or notes related to the booking
- Payment status and transaction-related information
Booking data is processed to enable the booking, manage the platform transaction, provide booking confirmations, support cancellations or changes, and handle user support. The legal basis is Art. 6(1)(b) GDPR.
Since the experiences are offered and carried out by independent organizers, booking data necessary for carrying out the experience may be shared with the respective organizer. Organizers may process such data as independent controllers for the purpose of providing the booked experience.
12. Communication between users and organizers
TripProfits may provide communication features between travellers and organizers. Messages and related metadata may be processed to enable communication, manage bookings, prevent misuse, resolve support cases, and protect users.
The legal basis is Art. 6(1)(b) GDPR where communication is necessary for booking or contract handling, and Art. 6(1)(f) GDPR for platform security, support, and misuse prevention.
13. Communication via WhatsApp
TripProfits may use WhatsApp to communicate with users, organizers, partners, or interested parties. The provider is:
WhatsApp Ireland Limited
4 Grand Canal Square
Grand Canal Harbour
Dublin 2
Ireland
Communication via WhatsApp may include messages related to support, booking information, organizer communication, account matters, or other service-related communication.
When WhatsApp is used, WhatsApp and Meta may process personal data, including phone numbers, message metadata, communication times, device information, and other data according to their own privacy terms. Depending on the technical setup, message content and metadata may also be processed through WhatsApp Business tools or related service providers.
The legal basis is Art. 6(1)(b) GDPR where communication is necessary for contractual or pre-contractual matters, Art. 6(1)(f) GDPR based on our legitimate interest in efficient communication, or Art. 6(1)(a) GDPR where consent is requested.
Further information is available in WhatsApp’s privacy policy: https://www.whatsapp.com/legal/privacy-policy-eea
14. Comments
If users can publish comments on TripProfits, we process the data entered in the comment form, the time of submission, the user account or display name, the e-mail address where required, and technical data such as the IP address.
This data is processed to display comments, manage user interaction, prevent spam and misuse, and respond to unlawful or abusive content. The legal basis is Art. 6(1)(a) GDPR where consent is requested, and Art. 6(1)(f) GDPR based on our legitimate interest in operating a safe and functional comment system.
Comments and related data may remain stored as long as the commented content is available, unless deletion is requested or required by law. Mandatory legal retention obligations remain unaffected.
15. Gravatar
TripProfits may use Gravatar to display user avatars in comments or user interactions. The provider is:
Automattic Inc.
60 29th Street #343
San Francisco, CA 94110
USA
Gravatar may process a hashed version of your e-mail address to check whether an avatar is associated with that e-mail address. If a Gravatar profile exists, the avatar may be displayed next to your comment or profile interaction.
The legal basis is Art. 6(1)(f) GDPR based on our legitimate interest in presenting user interactions in a recognizable and user-friendly way. Where consent is requested, the legal basis is Art. 6(1)(a) GDPR and § 25 TDDDG.
Further information is available in Automattic’s privacy policy: https://automattic.com/privacy/
16. Partner and referral program
TripProfits may offer a partner or referral program. If you participate in such a program, we may process data such as:
- User account data
- Referral codes or invitation links
- Referral relationships
- Qualifying platform activity, such as paid bookings or other eligible transactions
- Commission or reward calculations
- Payment and tax-related information where required
The purpose of this processing is to operate the referral or partner program, verify qualifying activity, calculate possible commissions, prevent abuse, and fulfill legal or accounting obligations.
The legal basis is Art. 6(1)(b) GDPR where processing is necessary for participation in the partner or referral program. Processing for fraud prevention, abuse prevention, and platform integrity is based on Art. 6(1)(f) GDPR. Processing required for tax or accounting purposes is based on Art. 6(1)(c) GDPR.
Commissions, if offered, are linked to genuine platform activity under the applicable program rules and are not based on registration alone.
17. Payments
If payments are enabled on TripProfits, payment processing is handled by external payment service providers. We do not store full credit card numbers or complete payment credentials on our own servers.
Payment-related data may include name, e-mail address, billing details, payment amount, payment status, transaction ID, refund status, chargeback information, and other information necessary to process payments, refunds, disputes, accounting, and fraud prevention.
The legal basis for payment processing is Art. 6(1)(b) GDPR. Processing required for accounting, tax, and legal obligations is based on Art. 6(1)(c) GDPR. Fraud prevention and secure payment handling may also be based on Art. 6(1)(f) GDPR.
Stripe
We may use Stripe for payment processing. Depending on your location and the specific payment flow, payment data may be processed by Stripe entities such as Stripe Payments Europe, Limited and/or Stripe Technology Europe, Limited.
Further information is available in Stripe’s privacy information: https://stripe.com/privacy
18. E-mail notifications
We may send transactional e-mails related to account creation, login security, booking confirmations, booking updates, organizer activity, platform notifications, support requests, or important service changes.
These messages are necessary to provide the platform and are processed on the basis of Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR.
Marketing newsletters are sent only where legally permitted, such as on the basis of consent or another applicable legal basis. If a newsletter is offered, users can unsubscribe at any time.
19. Social media plugins
TripProfits may integrate social media plugins, buttons, embedded posts, or links from social media platforms. Depending on the plugin, a connection to the provider’s servers may be established when the content is loaded or activated.
If social media plugins are activated, the respective provider may receive information such as your IP address, browser data, device information, the page visited, and, if you are logged in to the respective platform, may associate your visit with your user account.
Social media plugins are used only where legally permitted and, where required, only after your consent. The legal basis is Art. 6(1)(a) GDPR and § 25 TDDDG. Consent can be withdrawn at any time with effect for the future.
Facebook and Instagram
Facebook and Instagram services are provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.
Further information: https://www.facebook.com/privacy/policy/
X / Twitter
X services are provided by X Corp. and, for users outside the United States, may involve Twitter International Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland.
Further information: https://x.com/en/privacy
LinkedIn services are provided by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.
Further information: https://www.linkedin.com/legal/privacy-policy
20. Google Maps
TripProfits may use Google Maps to display maps, locations, meeting points, or experience-related location information. The provider is:
Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland
When Google Maps is loaded, Google may process data such as your IP address, device information, browser data, location-related data, and information about your interaction with the map. Data may also be transferred to Google entities outside the European Union or the European Economic Area.
Google Maps is used to provide location-related platform features and make experience locations easier to find. Where consent is required, the legal basis is Art. 6(1)(a) GDPR and § 25 TDDDG. Otherwise, the legal basis may be Art. 6(1)(f) GDPR based on our legitimate interest in providing useful location features.
Further information is available in Google’s privacy policy: https://policies.google.com/privacy
21. Google reCAPTCHA
TripProfits may use Google reCAPTCHA to protect forms, registrations, login pages, comments, or other platform features from spam, abuse, and automated attacks. The provider is:
Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland
reCAPTCHA may analyze user behavior and technical information to determine whether an interaction is performed by a human or an automated system. This may include IP address, browser and device information, mouse movements, time spent on the page, cookies, and other interaction data.
The legal basis is Art. 6(1)(f) GDPR based on our legitimate interest in protecting the website and platform from spam, abuse, and automated attacks. Where consent is required, the legal basis is Art. 6(1)(a) GDPR and § 25 TDDDG.
Further information is available here: https://policies.google.com/privacy and https://policies.google.com/terms
22. YouTube and embedded third-party content
TripProfits may embed videos or other content from third-party providers such as YouTube. The provider of YouTube is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
When embedded third-party content is loaded, the provider may process personal data such as IP address, browser data, device information, referrer URL, and interaction data. If you are logged in to the respective provider, your visit may be associated with your account.
Embedded third-party content is used to present platform content in an accessible and appealing way. Where consent is required, the legal basis is Art. 6(1)(a) GDPR and § 25 TDDDG. Otherwise, the legal basis may be Art. 6(1)(f) GDPR.
23. Google Fonts and Font Awesome
TripProfits may use fonts and icons to provide a consistent and user-friendly design.
If Google Fonts or Font Awesome are embedded locally, no connection to Google or Fonticons servers is established for loading the fonts or icons.
If fonts or icons are loaded from external servers, the respective provider may process technical data such as your IP address and browser information. Where consent is required, the legal basis is Art. 6(1)(a) GDPR and § 25 TDDDG. Otherwise, the legal basis may be Art. 6(1)(f) GDPR.
24. Data sharing
We share personal data only where this is necessary, legally required, or permitted under applicable law. Recipients may include:
- Hosting and IT service providers
- Authentication providers, such as Google or Meta, if social login is used
- Communication providers, such as WhatsApp, where communication is used
- Payment service providers
- Independent organizers, where necessary to provide booked experiences
- Support, communication, or e-mail service providers
- Tax advisors, accountants, banks, or legal advisors where required
- Authorities, courts, or public bodies where legally required
Where service providers process personal data on our behalf, we conclude appropriate data processing agreements where required under GDPR.
25. International data transfers
Some service providers may process personal data outside the European Union or the European Economic Area. Where this occurs, we ensure that appropriate safeguards are used where required, such as adequacy decisions, standard contractual clauses, or other legally recognized mechanisms.
26. Storage duration
We store personal data only as long as necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by law.
Account data is generally stored as long as the account exists. Booking, payment, invoice, tax, and accounting data may be stored for statutory retention periods. Contact requests are stored as long as necessary to process the request and any follow-up communication. Comments may remain stored as long as the related content remains available, unless deletion is requested or required by law.
27. Security
We use technical and organizational measures to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure.
This website uses SSL/TLS encryption. You can recognize an encrypted connection by the “https://” prefix and the lock symbol in your browser.
28. Your rights
Under the GDPR, you may have the following rights:
- Right of access to your personal data
- Right to rectification of inaccurate data
- Right to erasure of your data
- Right to restriction of processing
- Right to data portability
- Right to object to processing based on legitimate interests
- Right to withdraw consent at any time with effect for the future
- Right to lodge a complaint with a supervisory authority
To exercise your rights, contact us at: admin@tripprofits.com
29. Right to object under Art. 21 GDPR
If personal data is processed on the basis of Art. 6(1)(f) GDPR, you have the right to object to the processing of your personal data at any time on grounds relating to your particular situation.
If your personal data is processed for direct marketing purposes, you have the right to object to such processing at any time. If you object, your personal data will no longer be processed for direct marketing purposes.
30. Supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority. You may contact the authority responsible for your place of residence, your workplace, or the place of the alleged infringement.
For Berlin, the competent supervisory authority is:
Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59-61
10555 Berlin
Germany
31. Changes to this Privacy Policy
We may update this Privacy Policy when our services, legal requirements, or data processing activities change. The latest version is available on this website.
