Personal Data Controller
The controller of personal data within the meaning of European Union law is FraVeRa Journey, an economic activity registered in the Kingdom of the Netherlands, operating as a disclosed travel agent.
Article 4(7) GDPR - definition of data controller.
"controller" means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
Source: Regulation (EU) 2016/679, OJ EU L 119 of 04.05.2016, EUR-Lex.
The controller fulfills the information obligation towards data subjects through this Privacy Policy, made available on the website.
Article 13(1) GDPR - obligation to provide information when collecting data from the data subject.
Source: Regulation (EU) 2016/679, OJ EU L 119 of 04.05.2016, EUR-Lex.
The controller's identification data, including legal form, country of registration, registration number and contact details, are indicated in the Impressum and in the contact section of the website.
Article 13(1)(a) GDPR - obligation to indicate the identity and contact details.
FraVeRa Journey processes personal data independently and does not act as a joint controller of personal data within the meaning of Article 26 GDPR.
FraVeRa Journey is not obliged to appoint a data protection officer, as it does not meet the criteria specified in Article 37(1) GDPR.
The controller is subject to the law of the Kingdom of the Netherlands as a Member State of the European Union where it has its establishment, while simultaneously applying the directly applicable GDPR.
Article 3(1) GDPR - territorial scope.
National law NL: Uitvoeringswet AVG (UAVG), wetten.overheid.nl
Scope of Personal Data Processed
The controller processes only such personal data that are adequate, relevant and limited to what is necessary for the clearly defined purposes of processing.
Article 5(1)(c) GDPR - data minimization principle.
The controller may process identification and contact data, in particular name, surname, email address, telephone number and other data necessary for contacting and identifying the Client.
Article 6(1)(b) GDPR - performance of a contract.
The controller may process data concerning the planned trip, accommodation preferences, dates, scope of services and other organizational information.
The controller may process technical data including IP address, browser data, device, operating system and cookie identifiers, to the extent permitted by law and consent given.
• Article 6(1)(a) GDPR - consent
• Article 5(3) ePrivacy Directive
Implementation NL: Telecommunicatiewet Article 11.7a
The controller may process health data only when necessary for organizing a health or spa stay and only to the extent voluntarily provided. Not processed for diagnosis or treatment purposes.
• Article 9(2)(a) GDPR - explicit consent
• Article 9(2)(h) GDPR - health care organization
The controller does not process personal data that are not necessary to achieve the purposes indicated in this Privacy Policy.
Sources of Personal Data
3.1. Direct Collection
Data obtained directly from the data subject in the course of contact initiated by that person.
3.2. Online Forms
Data collected through forms on the website, technically handled by BASIN as processor.
3.3. Communication
Data from email correspondence, telephone conversations, and other direct communication.
3.4. Voluntary Documents
Documents or information voluntarily provided, including health data for stay finalization.
The controller does not collect personal data from covert sources, third-party databases or publicly available registers for the purpose of creating customer profiles.
Article 13 GDPR applies in most cases (data collected directly). Article 14 GDPR applies only in exceptional situations.
Purposes of Personal Data Processing
4.2. Offer Preparation
Preparing trip offers and taking steps before entering into an agency services contract.
4.3. Agency Services
Providing agency services including advice, intermediation, coordination and support.
4.4. Communication
Ongoing communication with the Client related to trip organization.
4.5. Partner Transfer
Transferring data to Partners providing main services (hotels, sanatoriums, transport).
4.6. Health Stays
Organizing health or spa stays and transferring information to medical Partners.
4.7. Legal Obligations
Fulfilling accounting, tax and archiving obligations.
Statistical analysis of website traffic using Google Analytics 4, only after obtaining user consent.
Article 6(1)(a) GDPR - consent
Marketing and remarketing purposes (Google Ads, Meta Ads) only after obtaining user consent, without combining with health data.
Legal Bases for Processing
Processing is carried out on the basis of Regulation (EU) 2016/679 (GDPR).
Article 6(1)(b) GDPR - Necessary for performance of a contract or steps before entering into a contract.
Article 6(1)(c) GDPR - Necessary for compliance with legal obligations (accounting, tax).
Article 6(1)(a) GDPR - Processing based on voluntarily, knowingly and unambiguously expressed consent.
• Article 9(1) - General prohibition on processing health data
• Article 9(2)(a) - Explicit consent exception
• Article 9(2)(h) - Health care organization exception
Article 5(3) ePrivacy Directive - Consent required for storing/accessing information in terminal equipment.
Article 7(3) GDPR - Right to withdraw consent at any time, without affecting prior lawful processing.
Special Category Data - Health Data Rules
⚕️ Health Data Protection
Health data is subject to special protection under GDPR Article 9. Processed only when absolutely necessary for organizing health and spa stays, with explicit consent and strict security measures.
Health data means personal data relating to the physical or mental health of a natural person, including information about the use of health care services (Article 4(15) GDPR).
Processing of health data is generally prohibited unless one of the legalizing premises is met (Article 9(1) GDPR).
• Explicit consent (Article 9(2)(a))
• Health care organization (Article 9(2)(h))
Under Article 9(2)(h), data must be processed by or under responsibility of a person subject to professional secrecy (Article 9(3) GDPR).
Preliminary stage: Only descriptive health information for matching stays.
Finalization stage: Health data transferred to Partner only to extent necessary for service performance.
Consent must be freely given, specific, informed and unambiguous. Demonstrable under Article 7(1) GDPR. Withdrawal possible at any time under Article 7(3) GDPR.
The controller does not provide medical advice, make diagnoses or therapeutic decisions. Health data processed solely for organizing and coordinating stays.
No automated decision-making or profiling based on health data (Article 22(1) GDPR).
• Storage limitation - Deleted or anonymized after organizational purposes (Article 5(1)(e))
• Security measures - Access restriction and authorization control (Article 32)
• Accountability - Compliance documentation (Article 5(2))
Recipients of Personal Data
The controller discloses personal data only to specified categories of recipients and only to the extent necessary to achieve the purposes of processing.
7.2. Service Partners
Sanatoriums, clinics, spa facilities, hotels, medical entities and transport companies - only to extent necessary for service performance.
7.3. Health Data Transfer
Only if necessary for health/spa services and on appropriate legal basis (explicit consent or health care basis).
7.4. IT Providers
IT service providers, hosting, email, form systems (BASIN) - exclusively as processors under Article 28 GDPR.
7.5. Analytics/Marketing
Google and Meta - only after user consent, to extent resulting from consent configuration and Consent Mode v2.
7.6. Public Authorities
Public authorities or authorized entities if obligation arises from EU or Dutch law.
The controller does not sell, provide for a fee or exchange personal data with other entities for commercial purposes unrelated to service provision.
Access to personal data is restricted to entities and persons for whom such access is necessary to achieve processing purposes.
The controller documents transfers of personal data to recipients and is able to demonstrate compliance with GDPR.
Transfer of Personal Data Outside EU/EEA
Transfer of personal data to third countries or international organizations is permissible only on the terms specified in Chapter V of the GDPR (Article 44).
Transfer is permissible if the European Commission has decided that the country ensures an adequate level of protection (Article 45(1) GDPR).
If no adequacy decision, transfer may take place with appropriate legal safeguards, in particular standard contractual clauses (Article 46 GDPR).
For tools provided by entities outside EU/EEA (Google, Meta), transfer takes place only in accordance with Chapter V GDPR mechanisms.
For transfers based on standard contractual clauses, the controller conducts a transfer impact assessment to verify whether third country law undermines safeguards (CJEU Judgment C-311/18 - Schrems II).
Health data is transferred outside EU/EEA only in exceptional cases, if conditions of Chapter V GDPR and Article 9 GDPR are jointly met.
In absence of adequacy decision and safeguards, transfer may take place only on basis of exceptions in Article 49 GDPR, applied restrictively.
The controller informs data subjects about intention to transfer data outside EU/EEA and about applied safeguards or exceptions (Article 13(1)(f)).
The controller documents all cases of data transfer outside EU/EEA and is able to demonstrate compliance with GDPR.
Cookies and Similar Technologies
Cookies and similar technologies (including localStorage, sessionStorage, pixels, tags and online identifiers) constitute information stored or read in the user's terminal equipment.
Article 5(3) of Directive 2002/58/EC (ePrivacy)
Implementation NL: Telecommunicatiewet Article 11.7a, wetten.overheid.nl
The controller uses necessary, analytical and marketing cookies, where cookies other than necessary are activated only after obtaining user consent.
Necessary cookies are used solely to ensure the proper functioning of the website and its basic features and do not require user consent.
Article 5(3) second sentence of Directive 2002/58/EC - exception for "strictly necessary" cookies.
"...this shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order to provide an information society service explicitly requested by the subscriber or user."
Analytical cookies are used for statistical analysis of website traffic using Google Analytics 4, only after obtaining user consent.
• Article 6(1)(a) GDPR - consent
• Article 5(3) ePrivacy Directive
Sources: GDPR; Directive 2002/58/EC; GA4 Documentation
Marketing and remarketing cookies (Google Ads, Meta Ads) are used only after obtaining user consent for displaying personalized advertisements and analyzing campaign effectiveness.
The controller uses a consent management platform (CMP) that allows the user to express, refuse or change consent for the use of cookies.
Article 7(1) and (3) GDPR - proof of consent and its withdrawal.
The controller uses Google Consent Mode v2, which transmits consent signals to Google for categories: ad_storage, analytics_storage, ad_user_data, ad_personalization.
Lack of consent for analytical or marketing cookies does not affect the ability to use the website, except for functions directly related to these cookies.
Article 7(4) GDPR - voluntariness of consent.
The cookie storage period depends on their type and is indicated in the detailed Cookie Policy or in the CMP settings.
The controller ensures easy access to information about cookies used and enables changing consent settings at any time via a link in the website footer.
Personal Data Storage Period
Personal data are stored in a form that permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.
Article 5(1)(e) GDPR - storage limitation principle.
10.3. Offer Preparation Data
Stored for duration of contact and after termination for time necessary to secure any claims.
10.4. Contract Data
Stored for duration of contract and after termination for period required by law or until expiry of limitation periods.
10.5. Legal Obligations
Stored for period resulting from applicable law, in particular tax and accounting law.
10.6. Health Data
Stored only for period necessary to organize and carry out health stay, then promptly deleted or anonymized.
10.7. Consent-based Data
Stored until consent is withdrawn or until they lose usefulness for the purpose consent was given.
10.8. Analytics/Marketing
Stored in accordance with validity period of cookies or until user withdraws consent.
After the storage period expires, personal data are deleted or anonymized in a manner that prevents identification of the data subject.
The controller documents the adopted data storage periods and is able to demonstrate their compliance with GDPR principles.
Rights of the Data Subject
📋 Your Rights Under GDPR
As a data subject, you have comprehensive rights regarding your personal data. These rights are exercised free of charge unless requests are manifestly unfounded or excessive.
Right to Information
Receive information concerning processing in a concise, transparent, intelligible and easily accessible form.
Right of Access
Obtain confirmation whether personal data are being processed and access to the personal data.
Right to Rectification
Obtain without undue delay the rectification of inaccurate personal data and completion of incomplete data.
Right to Erasure ("Right to be Forgotten")
Obtain erasure of personal data when data are no longer necessary for the purposes for which they were processed.
Right to Restriction
Obtain restriction of processing in cases indicated in the GDPR.
Right to Data Portability
Receive personal data in a structured, commonly used, machine-readable format and transmit to another controller.
Right to Object
Object at any time to processing based on legitimate interest of the Controller.
Right to Withdraw Consent
Withdraw consent at any time, without affecting lawfulness of processing based on consent before withdrawal.
Right Not to be Subject to Automated Decisions
Not to be subject to a decision based solely on automated processing, including profiling.
The data subject has the right to lodge a complaint with the competent supervisory authority if he or she considers that processing infringes GDPR provisions.
Competent authority in NL: Autoriteit Persoonsgegevens - autoriteitpersoonsgegevens.nl
Article 77(1) GDPR
The controller implements rights of the data subject without undue delay, no later than within one month of receipt, with possibility of extension in indicated cases.
Article 12(3) GDPR
Right to Lodge a Complaint with Supervisory Authority
The data subject has the right to lodge a complaint with a supervisory authority if he or she considers that the processing of personal data infringes GDPR provisions.
Article 77(1) GDPR
The competent supervisory authority is the Autoriteit Persoonsgegevens in the Kingdom of the Netherlands.
Website: autoriteitpersoonsgegevens.nl
The data subject may lodge a complaint with the supervisory authority in the Member State of his or her habitual residence, place of work or place of the alleged infringement.
The right to lodge a complaint is independent of other legal remedies, including the right to lodge a complaint with a court.
The controller cooperates with the competent supervisory authority in the performance of its tasks and provides all required information.
• Article 78 GDPR - Right to effective judicial remedy against decision of supervisory authority
• Article 79 GDPR - Right to effective judicial remedy against the Controller
Lodging a complaint with the supervisory authority is free of administrative charges.
Technical and Organizational Security Measures
The controller implements appropriate technical and organizational measures to ensure a level of security of personal data appropriate to the risk.
Article 32(1) GDPR
13.2. Selection Criteria
State of the art, implementation costs, nature, scope, context and purposes of processing, and risk assessment.
13.3. CIA Triad
Confidentiality, Integrity and Availability of data and resilience of processing systems.
13.4. Access Control
Access granted only to authorized persons and only to extent necessary to perform their tasks.
13.5. Technical Measures
IT system security, access protection, encryption and pseudonymization to extent adequate to risk.
13.6. Health Data Security
Heightened protection standards including access restrictions, transfer control and shortened storage.
13.7. Testing
Regular testing, measuring and evaluating effectiveness of applied measures.
The controller uses only processors providing sufficient guarantees to implement appropriate technical and organizational measures.
The controller has procedures enabling detection, reporting and assessment of personal data breaches.
The controller documents applied security measures and is able to demonstrate compliance with GDPR.
Personal Data Breaches
A personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data.
Article 4(12) GDPR
The controller implements procedures enabling immediate detection, analysis and assessment of each personal data breach.
After detecting a breach, the controller conducts an assessment of the risk of infringement of rights or freedoms of natural persons.
If a breach may result in risk to rights and freedoms, the controller reports it to the supervisory authority without undue delay, no later than 72 hours from becoming aware.
Article 33(1) GDPR
The report includes: nature of breach, categories of data, possible consequences, and measures taken or proposed.
The controller documents all personal data breaches, regardless of whether they were subject to reporting obligation.
If breach may result in high risk to rights and freedoms, the controller notifies the data subject without undue delay.
Article 34(1) GDPR
Notification not required if technical measures eliminating risk have been applied or other premises in Article 34(3) GDPR are met.
Breaches involving health data are subject to particularly rigorous risk assessment and as a rule qualify as high-risk breaches.
The controller cooperates with supervisory authority and is able to demonstrate compliance of breach response procedures with GDPR.
Changes to Privacy Policy
The controller is entitled to make changes to the Privacy Policy in the event of changes in law, changes in manner or scope of processing, changes in applied technologies or business development.
The controller ensures that information provided to data subjects is up-to-date, reliable and corresponds to actual manner of data processing.
The current version of the Privacy Policy is published on the website and marked with the date of entry into force.
If changes concern essential aspects of processing, the controller ensures fulfillment of information obligations towards data subjects.
Changes to the Privacy Policy do not have retroactive effect and do not affect lawfulness of processing carried out before entry into force of changes.
Changes introduced to adapt to mandatory provisions of law apply from date of entry into force of those provisions.
The controller documents the Privacy Policy update process and is able to demonstrate compliance with GDPR principles.
This Privacy Policy enters into force on the date of its publication, unless another date is expressly indicated.