Privacy Policy

This Privacy Policy explains how Ananas GDS UG (haftungsbeschränkt) processes personal data in connection with the Ananas GDS platform (the “ Platform ”), its website at ananas-gds.com , and related services. It satisfies the transparency obligations of Articles 12, 13 and 14 of Regulation (EU) 2016/679 (“ GDPR ”) and the German Federal Data Protection Act (BDSG).

1. Controller

General contact details are set out in our Imprint .

2. Data Protection Officer

Ananas GDS UG has assessed its obligation to appoint a Data Protection Officer under Art. 37 GDPR and § 38 BDSG. As of the effective date, the statutory thresholds requiring the mandatory appointment of a DPO are not met. A qualified contact for data-protection questions is available at privacy@ananas-gds.com and will respond within the statutory deadlines. We review this assessment at least annually.

3. Scope of this notice

This notice applies when you:

• visit our website or marketing pages;
• create or administer a user account on the Platform (accommodation provider, tour operator, sub-user);
• use Platform features (facts management, stop sale calendars, photos, surveys, partner connections);
• connect to our public APIs via a partner token;
• contact us by email, support form, or phone.

Where we process personal data on behalf of a customer (e.g. guest-related data embedded in a fact sheet, partner contract, or survey upload), we act as a processor under Art. 28 GDPR. The legal basis and purpose of such processing are determined by the customer as controller; please refer to that customer’s own privacy notice and to our Data Processing Agreement .

4. Categories of personal data we process

Depending on how you interact with us, we may process:

Category	Examples
Account data	first/last name, business email, phone, role, company name, preferred language, time zone
Authentication data	hashed password, API tokens, session identifiers, two-factor settings
Profile data	user permissions, sub-user relationships, property access, avatar
Business data	property fact sheets, stop-sale entries, allotments, photos, contracts, surveys
Billing data	subscription plan, invoices, VAT-ID, billing address, Stripe customer ID, last-4 of payment method
Usage / technical	IP address, browser type and version, OS, device ID, timestamps, requested URLs, referrer, error logs, approximate country (derived from an anonymised IP, website analytics only)
API analytics	endpoint called, token used, success/failure status, bytes transferred, date
Communication data	support tickets, email correspondence, meeting notes
Cookies / local storage	session cookie, preference keys, authentication token (see clause 10)

We do not knowingly collect special categories of personal data within the meaning of Art. 9 GDPR, nor children’s data.

5. Purposes of processing and legal bases

5.1 Providing the Platform — Art. 6(1)(b) GDPR (contract)

Creating and administering accounts, authenticating users, provisioning API tokens, storing and distributing business data to authorised partners, delivering features included in your subscription.

5.2 Billing, accounting, and tax — Art. 6(1)(b), 6(1)(c) GDPR

Issuing invoices, processing Stripe payments, complying with retention obligations under §§ 147 AO and 257 HGB (up to 10 years for commercial and tax records).

5.3 Security and fraud prevention — Art. 6(1)(f) GDPR (legitimate interest)

Rate limiting, abuse detection, bot protection, logging of failed logins, monitoring of suspicious API use, investigation of incidents. Our legitimate interest lies in maintaining the security, availability, and integrity of the Platform for all users.

5.4 Platform analytics and improvement — Art. 6(1)(f) GDPR

Aggregated and privacy-preserving usage statistics to improve performance, identify bugs, and prioritise features. Data is aggregated or pseudonymised wherever possible.

5.5 Customer communication and support — Art. 6(1)(b), 6(1)(f) GDPR

Service notifications, incident advisories, support tickets, onboarding messages, and administrative announcements.

5.6 Marketing of our own similar services — Art. 6(1)(f) GDPR; § 7 para. 3 UWG

To existing business customers, in connection with their subscription, with a clear opt-out in every message. Other direct marketing takes place only with prior consent (Art. 6(1)(a) GDPR).

5.7 Legal claims and compliance — Art. 6(1)(c), 6(1)(f) GDPR

Defence of legal claims, compliance with court orders, lawful requests from authorities, enforcement of our Terms.

5.8 Cookies and local storage — Art. 6(1)(f) GDPR; § 25 TDDDG

Strictly necessary cookies and local-storage entries needed to deliver the Service you have requested. Non-essential cookies are only set with prior consent.

5.9 Website analytics — Art. 6(1)(f) GDPR (anonymous measurement) and Art. 6(1)(a) GDPR; § 25 para. 1 TDDDG (statistics)

On our public website we operate a self-hosted Matomo instance to produce aggregate visitor statistics. We host it ourselves and share the data with no third-party analytics provider. It runs in two separate tiers:

• Anonymous measurement (no consent). A storage-less page count that writes nothing to, and reads nothing from, your device — no cookies, no local storage, no device fingerprint. It processes only what your browser transmits anyway (page address, referrer, browser identification, and your IP address, which is shortened before storage) to produce visit counts and approximate country, device class and traffic source. It cannot identify you or track you across sites. Because nothing is stored on or read from your terminal equipment, § 25 TDDDG is not engaged; our legal basis is Art. 6(1)(f) GDPR — our legitimate interest in operating, securing and improving the website. You may object at any time (Art. 21 GDPR) by switching “Anonymous measurement” off in our privacy preference centre, reachable from the Cookie settings link in the footer of every page.
• Statistics (consent). Visit grouping, scroll depth, time on page and clicks on buttons and outbound links run only after you switch on the Statistics category in our banner, and store the entries listed in our Cookie Policy in your browser. Legal basis: § 25 para. 1 TDDDG with Art. 6(1)(a) GDPR . You may withdraw at any time; the stored entries are then deleted immediately.

Both tiers are cookieless and honour the “Do Not Track” browser signal. See clause 10 and our Cookie Policy .

6. Recipients and sub-processors

We share personal data only with recipients that have a legitimate need:

• Your authorised business partners , with respect to the data you have explicitly granted them access to via the permission system or API tokens;
• Sub-processors that provide infrastructure, hosting, email delivery, payment processing, and support tooling on our behalf, under written contracts in accordance with Art. 28 GDPR;
• Professional advisors such as lawyers, tax advisors, and auditors, under statutory confidentiality duties;
• Public authorities , where required by law;
• Acquirers or successors , in the event of a merger, reorganisation, or sale of assets, subject to the same protections.

A current list of sub-processors is maintained in our Data Processing Agreement and in response to written requests to privacy@ananas-gds.com.

7. International transfers

The Platform is primarily hosted inside the European Economic Area (EEA). Where personal data is transferred to a country outside the EEA — for instance, for payment processing or certain support services — such transfers only take place on the basis of an adequacy decision (Art. 45 GDPR) or appropriate safeguards (Art. 46 GDPR), in particular the Standard Contractual Clauses adopted by the European Commission in Decision (EU) 2021/914, supplemented by a transfer impact assessment and additional technical and organisational measures where necessary.

Transfers to the United States based on the EU-US Data Privacy Framework (where the recipient is certified) are treated as transfers to a country with an adequacy decision in accordance with Commission Implementing Decision (EU) 2023/1795. A copy of the applicable safeguards is available on request to privacy@ananas-gds.com.

8. Retention

We retain personal data only for as long as necessary for the purposes set out above:

• Account data: for the duration of the subscription and up to 30 days after termination, after which it is deleted or anonymised, unless longer retention is required by law;
• Billing and tax records: up to 10 years, in accordance with §§ 147 AO and 257 HGB;
• API analytics: aggregated indefinitely; per-call logs retained for up to 12 months;
• Security and abuse logs: up to 12 months, unless needed for a specific investigation;
• Support correspondence: up to 3 years after closure of the ticket;
• Marketing preferences and opt-outs: until you renew or withdraw them.

9. Your rights as a data subject

Subject to the conditions set out in the GDPR, you have the right to:

• access the personal data we hold about you (Art. 15 GDPR);
• rectification of inaccurate or incomplete data (Art. 16 GDPR);
• erasure (“right to be forgotten”, Art. 17 GDPR);
• restriction of processing (Art. 18 GDPR);
• data portability in a structured, commonly used, machine-readable format (Art. 20 GDPR);
• object to processing based on legitimate interests (Art. 21 GDPR), including a general right to object to direct marketing at any time;
• withdraw consent at any time, without affecting the lawfulness of prior processing (Art. 7(3) GDPR);
• not be subject to fully automated individual decisions producing legal effects (Art. 22 GDPR); the Platform does not make such decisions.

To exercise any of these rights, contact privacy@ananas-gds.com . We respond within one month of receipt (Art. 12(3) GDPR), extendable by up to two further months where necessary.

Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). Our lead supervisory authority is:

10. Cookies and tracking

The Platform uses only strictly necessary first-party cookies and local-storage entries needed to authenticate you, keep you signed in, and remember essential preferences such as language or theme. These are set on the basis of § 25 para. 2 No. 2 TDDDG and do not require consent.

On our public website ( ananas-gds.com ) we use Matomo analytics, which we host ourselves at analytics.ananas-gds.com — not Google Analytics or any third-party service. It is configured cookieless (it sets no cookies or identifiers on your device) and with IP anonymisation , and it respects “Do Not Track” . A storage-less page count — writing nothing to and reading nothing from your device — runs for all visitors on the basis of Art. 6(1)(f) GDPR and can be switched off entirely at any time via Cookie settings in the footer. Everything behavioural (visit grouping, scroll depth, time on page, button clicks) loads only after you switch on the Statistics category in the consent banner; you may decline or withdraw at any time with no loss of functionality. Full detail is in clause 5.9. It collects aggregate statistics such as pages viewed, approximate country, device and browser type, and the referring website. We do not use marketing cookies, cross-site trackers, social-plugin embeds, advertising identifiers, or any third-party analytics. If we introduce any further non-essential tracking in the future, we will obtain prior, specific, informed consent in accordance with § 25 para. 1 TDDDG and Art. 7 GDPR. See our Cookie Policy .

11. Security

We take appropriate technical and organisational measures to protect personal data, including: TLS/HTTPS encryption in transit; encryption at rest for sensitive credentials; hashed and salted passwords; role-based access control and least privilege; logging and monitoring of security-relevant events; regular back-ups and disaster recovery; patching and vulnerability management; and confidentiality and training obligations for personnel.

In the event of a personal data breach likely to result in a risk to the rights and freedoms of natural persons, we will notify the competent supervisory authority within 72 hours of becoming aware (Art. 33 GDPR) and, where required, affected data subjects (Art. 34 GDPR).

12. Children

The Platform is not intended for children and is not offered to persons under 18. We do not knowingly collect personal data from children. If you believe that a child has provided us with personal data, please contact privacy@ananas-gds.com and we will delete it without undue delay.

13. No obligation to provide data

The provision of certain personal data is necessary for the conclusion and performance of the contract — for example, account, billing, and authentication data. Without this data we cannot provide the Platform. The provision of other data (e.g. optional profile fields) is voluntary.

14. Automated decision-making

We do not use fully automated individual decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of Art. 22 GDPR.

15. Changes to this notice

We may update this Privacy Policy to reflect changes in our processing or in legal requirements. The current version is always available at the URL shown in the Platform footer. Material changes will be highlighted and communicated to customers via email or in-Platform notification.

This Privacy Policy forms part of our Terms of Service and is complemented by our Data Processing Agreement , Cookie Policy , and Imprint . Effective 14 April 2026 · Last updated 24 July 2026.