Privacy Policy

1. Introduction and Data Controller

Vaultsortnst Travel Media Ltd. ("Vaultsortnst", "we", "us", or "our"), registered under Company Registration No. OC-849204-EU with registered offices at 44 Keizersgracht, 1015 CR Amsterdam, Netherlands, operates the web domain vaultsortnst.forum (the "Service"). We act as the Data Controller under Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation or "GDPR").

This Privacy Policy sets forth our strict operational practices concerning the collection, storage, processing, transfer, and safeguarding of Personal Data collected from visitors, registered forum contributors, and users of our interactive 48-Hour City Planner tools.

2. Categories of Personal Data We Collect

We restrict our data intake to strictly necessary operational parameters:

• Technical and Device Identifiers: Truncated IP addresses (anonymized at ingestion), browser architecture, viewport resolution, operating system, HTTP referrers, and network timestamps.
• Interactive User-Generated Preferences: Saved destination choices, selected travel tempos, custom 48-hour itinerary completion states, and filter parameters saved within client-side local storage.
• Direct Communications Data: Your name, email address, editorial contribution submissions, and enquiry metadata when you submit our contact forms or message our editorial team at [email protected].
• Cookie and Tracking Analytics: Pseudonymized behavioral metrics regarding page scroll depth, itinerary module generation rate, and outbound affiliate transit links (subject to your explicit consent).

3. Legal Bases for Processing Under GDPR (Article 6)

We process your personal information strictly in accordance with one or more of the following legal grounds:

1. Consent (Art. 6(1)(a)): Where you provide express, affirmative consent (e.g., opting in to non-essential analytics cookies via our persistent consent banner or subscribing to editorial dispatch bulletins).
2. Contractual Performance (Art. 6(1)(b)): To deliver requested features, such as generating dynamic itinerary schedules and preserving interactive trip progress.
3. Legitimate Interests (Art. 6(1)(f)): To maintain web infrastructure security, prevent automated spam attacks on our forum endpoints, diagnose server latency, and optimize our European city break content.
4. Legal Obligations (Art. 6(1)(c)): To comply with Dutch commercial accounting, tax, and regulatory requirements under European Union law.

4. Third-Party Sub-Processors and Data Transfers

We do not sell, rent, or lease your Personal Data to data brokers or advertising exchanges. Data may only be shared with carefully audited sub-processors who adhere to strict GDPR Standard Contractual Clauses (SCCs):

• Infrastructure Hosting: Cloudflare Inc. (Edge CDN, SSL encryption, and DDoS defense) operating data centers in Frankfurt and Amsterdam.
• Typography Delivery: Google Fonts (cached locally and proxied to eliminate third-party user IP tracking).
• Transactional Communications: Postmark / AWS SES (EU-West Ireland Region) for dispatching customer service acknowledgments.

5. Your Statutory Rights Under GDPR and CCPA

Depending on your geographic residency, you hold fundamental legal rights regarding your data:

• Right of Access (GDPR Art. 15): Request a structured copy of all Personal Data currently held by Vaultsortnst concerning your identity.
• Right to Rectification (GDPR Art. 16): Correct inaccurate, outdated, or incomplete data records.
• Right to Erasure / "To Be Forgotten" (GDPR Art. 17): Demand permanent deletion of your data from our active databases and backup routines.
• Right to Restrict or Object to Processing (GDPR Arts. 18 & 21): Freeze or oppose certain data operations, particularly direct analytics profiling.
• Right to Data Portability (GDPR Art. 20): Receive your itinerary data in a standard JSON/CSV format for external transfer.
• CCPA Non-Discrimination: California residents will never experience degraded pricing or site speed for exercising privacy rights.

6. Data Retention Protocols

Client-side planner configuration data stored in localStorage remains exclusively on your personal hardware until cleared by you or overwritten upon manual reset. Server access logs are automatically rotated and purged after 30 days. Direct editorial emails are retained for a maximum of 24 calendar months for accountability and legal record-keeping.

7. Data Protection Officer (DPO) Contact

To exercise any of your statutory rights or submit a formal inquiry to our Data Protection Officer, please contact: