Privacy summary

Overview

You can read every page of Hiroshima Tour without an account. The site sets no cookies and runs no analytics, advertising or tracking scripts. What does reach us is the connection data that any web server sees when it sends you a page, and it is described below.

Booking never happens on this site. Once you choose a tour you book on GetYourGuide or Viator, where their privacy rules govern.

Who to contact

Hiroshima Tour
[email protected]

No law requires us to name a data protection officer, so we have none. Questions about your data go to [email protected].

Entries in our server log

For every page or file your browser fetches, our web server writes down the requesting IP address, the date and time, the path asked for, the referring page and the browser and system description your browser reports about itself.

We need these entries to deliver the site, keep it steady, detect attacks and abuse and count how many times each page is read. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in a site that runs and stays safe. Raw entries are deleted after 90 days at the latest; counts without IP addresses are kept longer. A hosting company runs the server and processes this data for us strictly on our instructions.

Services before our server

This domain's pages and email run via Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA), which delivers pages quickly, filters out attacks and relays email to our inbox. Doing so, Cloudflare handles your IP address and technical connection data.

The legal basis is Article 6(1)(f) GDPR, our interest in a site that is fast and protected. Cloudflare is certified under the EU-US Data Privacy Framework and the standard contractual clauses of the European Commission apply too. Its policy sits at cloudflare.com/privacypolicy.

Photos used for the trips

Tour pictures come straight from the image servers of GetYourGuide (GetYourGuide Deutschland GmbH, Sonnenburger Straße 73, 10437 Berlin, Germany). To show one, your browser connects to those servers and gives them your IP address, which we cannot affect.

The legal basis is Article 6(1)(f) GDPR: we want every tour illustrated with the provider's own current photos.

The step to a booking site

Each booking link goes directly to GetYourGuide or Viator and includes our partner number, which lets the platform assign the booking to us.

After you land on GetYourGuide or Viator, that platform sets its own cookies and handles your data under its own privacy policy. We only get commission statements with totals, never names, contact data or payment details.

Embedded films

Videos load in YouTube's privacy-enhanced mode and show a still picture until you press play, with no contact with YouTube before that. After you press play the video comes from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), which gets your IP address and may set cookies.

Pressing play means you agree: Article 6(1)(a) GDPR and Section 25(1) TDDDG. Google's privacy policy is at policies.google.com/privacy.

Items kept by your browser

Your browser holds a few small items so the site can follow your choices. They never leave your device and we are unable to read them:

• which boxes you ticked on a list, so they are still ticked when you return (local storage, until you wipe it);
• the currency chosen in the menu, so each page shows prices in it (local storage, until you wipe it);
• after you open a chat: a reference number, an access key, your email address and a copy of the exchange, so you can continue later (local storage, until you wipe it);
• that the chat bubble has popped up once already, so it does not return (session storage, discarded when the tab closes);
• that the leaving-the-page reminder was already displayed, so it does not repeat (session storage, discarded when the tab closes).

These items are strictly necessary for functions you switch on yourself (Section 25(2) No. 2 TDDDG). Your browser settings let you erase them whenever you like.

Our live chat

Opening a chat means handing us your name, email address and messages. The chat service also logs the country your connection comes from, an obscured form of your IP address (a salted hash, impossible to turn back into the address) and the page and language you wrote from.

Chats are kept with Cloudflare (named above) and every message you write is passed to our account at the Telegram messaging service, which handles it outside the European Union; our replies come back along the same path. Further details: telegram.org/privacy. Your email address is used for replying and nothing else.

The legal basis is Article 6(1)(b) GDPR, as you ask and we reply, and Article 6(1)(f) GDPR for the obscured IP address, which serves only to fend off abuse and spam. Each chat is deleted on its own 180 days after the last message.

Messages by email

Whatever you email us is used to answer you. The legal basis is Article 6(1)(f) GDPR, with Article 6(1)(b) GDPR if you write about a contract. We remove the exchange when it has ended, unless the law makes us keep it.

Typefaces and map images

Typefaces load from our own server, so no font provider learns that you visited. Maps are images stored on our server and drawn from OpenStreetMap data; looking at or zooming them contacts no map provider. A "Google Maps" link opens Google only after you press it.

Outbound source links

Our pages quote official and expert sources and link to them. Those sites hear nothing from you unless you follow a link; from there, their own privacy terms apply.

Requests you may make

You can request the data we hold on you (Article 15 GDPR), its correction (Article 16) or deletion (Article 17), a restriction of processing (Article 18) and a portable copy (Article 20). Where we rely on legitimate interest you can object at any time (Article 21), and a consent you gave can be withdrawn for the future. Send an email to [email protected].

You may also lodge a complaint with a data protection supervisory authority, above all in the EU country where you live or work or where the breach is said to have happened (Article 77 GDPR).

No automated decision-making or profiling takes place. You do not have to give us data, although a page cannot reach your screen without technical connection data.