Basant Tours
DEEN

Privacy Policy

At a Glance

Basant Tours is a company based in Egypt; the website is technically operated with a hosting provider in Germany. This privacy policy explains which personal data is processed as a result, as well as when you make an enquiry through our forms or WhatsApp. In brief:

  • We operate this website as a static website with a hosting provider in Germany (see “Hosting”) — the controller for the processing remains Basant Tours in Egypt (see “Controller”).
  • If you contact us via one of our forms, via WhatsApp, or directly, we process the data provided solely to handle your enquiry.
  • You can choose between email and WhatsApp as your contact method.
  • This website does not use cookies or any analytics or marketing services; there is therefore no cookie/consent banner either (see “Cookies and Tracking”).
  • Your rights as a data subject are summarized in the “Your Rights” section.

Controller

The party responsible for data processing on this website is:

Basant Tours Limousinen Service
Authorized to represent: Daoud Francis Maurice Riad
Hurghada, Red Sea Governorate, Egypt
Phone/WhatsApp: +20 (122) 835 8615
Email: basanttours@gmail.com

Basant Tours Limousinen Service is based in Egypt and therefore outside the EU/EEA. The hosting provider (All-Inkl, see “Hosting”) and the technical implementation partner (Oberlanddesign, see Legal Notice) are not responsible for the customer data processed on this website — both are merely technical service providers, not the operator of Basant Tours.

Scope: Why the GDPR Applies Despite Our Base in Egypt

Basant Tours Limousinen Service has no establishment in the European Union. This privacy policy is nevertheless based on the European General Data Protection Regulation (GDPR), because Art. 3(2)(a) GDPR (target-market principle) applies: this website, with its German-language content and prices in euros, is expressly directed at people in the European Union and offers them excursion and transfer services for payment. Whether a payment actually takes place is irrelevant. The GDPR therefore applies to the processing described in this policy, regardless of the website's hosting location and regardless of Basant Tours Limousinen Service's base in Egypt.

General Information on Data Processing

We treat your personal data confidentially and in accordance with statutory data protection regulations and this privacy policy. Personal data is data that can be used to personally identify you. We would like to point out that data transmission over the internet (e.g. when communicating by email) may generally have security vulnerabilities; complete protection of data against access by third parties is not possible.

Legal bases: Where your data is required to process an enquiry you have submitted or to initiate a booking, we process it on the basis of Art. 6(1)(b) GDPR. Otherwise, processing may be based on our legitimate interest under Art. 6(1)(f) GDPR, for example in efficiently handling your enquiry. Separate consent under Art. 6(1)(a) GDPR is not required to send an enquiry you initiate yourself, and is therefore not collected via a mandatory checkbox.

Recipients: We only disclose personal data to third parties where this is necessary to process your enquiry (e.g. to our hosting provider, or to Google as part of receiving email, see below), where you choose the WhatsApp route, or where we are legally obliged to do so. Data is not disclosed for advertising purposes.

Hosting of the Website in Germany

We host the content of our website with the following provider:

All-Inkl
The provider is ALL-INKL.COM – Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany (hereinafter All-Inkl). Details can be found in All-Inkl’s privacy policy: all-inkl.com/datenschutzinformationen.

When you access our website, All-Inkl automatically processes technically necessary access data (so-called server log files), including the IP address of your device, the date and time of access, the page or file accessed, the access status, the amount of data transferred, the referring page (referrer), and your browser, operating system and language. This processing happens automatically and cannot be opted out of by us. According to All-Inkl’s public information, these server log files are deleted after seven days at the latest, except in individual cases (e.g. an attack on the IT systems) where longer retention may be necessary.

No database or file storage of our own: Beyond the server log files, this website does not operate its own database and does not permanently store data submitted via our enquiry form in the server's file system — form data is processed solely for immediate forwarding by email (see “Forms” below).

The use of All-Inkl is based on Art. 6(1)(f) GDPR (legitimate interest in a reliable technical provision of the website). We have entered into, or are entering into, a data processing agreement (DPA) with All-Inkl under its standard agreement.

Forms: Tour, Transfer and Contact Enquiries

For enquiries about our excursions, the airport transfer, and general matters, we provide three forms (on the tour detail pages, the transfer page, and the contact page). All three work on the same principle: you choose between the sending method email and WhatsApp; depending on the method chosen, we request different information.

Email route. If you select “email”, we request the following information:

  • for a tour enquiry: name, email address, hotel, room number, preferred day, number of adults and children, and optionally a message;
  • for a transfer or general contact enquiry: name, email address, optionally a phone number, and a message.

Technical process: When you submit the form, your browser transmits the information via HTTPS to a script on our web server at All-Inkl (Germany). This script checks and truncates the input, limits the number of possible enquiries per sender (rate limiting — for this, only an irreversibly hashed identifier of your IP address, not traceable back to you, is stored together with a timestamp for a maximum of ten minutes), and then sends the information by SMTP as an email to our mailbox basanttours@gmail.com (Google/Gmail, see “Receiving Email via Google” below). The form data itself is at no point permanently stored by the server or placed in a database — it merely passes through the German server technically for immediate forwarding. The incoming email then remains in our mailbox until we delete it or the purpose of processing no longer applies.

Your email address serves two purposes: first, we need it to process your enquiry and be able to reply to you. Second, it is technically stored as the so-called reply-to address of the message sent to us, so that our reply goes directly to you.

The legal basis is Art. 6(1)(b) GDPR, to the extent your enquiry serves to initiate a booking, and otherwise our legitimate interest in the efficient handling of incoming enquiries (Art. 6(1)(f) GDPR).

WhatsApp route. If you select “WhatsApp” instead, we request neither an email address nor a phone number. How this route works is explained in the “WhatsApp as a Contact Method” section.

Direct Contact by Email, Phone or WhatsApp

If you contact us directly outside of the forms — e.g. via the email address or phone number stated in the Legal Notice, or via the WhatsApp button in the header or footer of the website — we process the data you provide (including name, contact details, and the content of your message) solely to handle your matter. The legal basis here is also Art. 6(1)(b) or (f) GDPR. The following section additionally applies to the WhatsApp route.

WhatsApp as a Contact Method

In addition to email, we offer WhatsApp as a voluntary, alternative contact method. You can use the email route instead at any time — neither of the two routes is mandatory.

How the handover to WhatsApp works technically: If you select “WhatsApp” in the form, we do not request an email address or a phone number. From your remaining entries, your browser locally creates a pre-formulated message on your own device and uses it to open WhatsApp or wa.me. Up to this point, no data is transmitted to WhatsApp, to Meta, or to our server — this happens exclusively in your own browser. Only once you actually send the prepared message in WhatsApp do you leave our website and switch to the WhatsApp application or website; further communication then takes place directly through your own WhatsApp account and is received by Basant Tours in its own WhatsApp account.

Provider: WhatsApp is currently provided for users in the EEA by WhatsApp Ireland Limited; the parent company Meta Platforms, Inc. is based in the USA. Messages on WhatsApp are end-to-end encrypted; however, according to WhatsApp’s own statements, the service additionally processes metadata of the communication (including sender, recipient, timestamp), which may be transmitted to Meta in the USA. The current basis for this is the European Commission’s adequacy decision on the EU-US Data Privacy Framework of 10 July 2023, for which Meta is certified. Further and always up-to-date information can be found in WhatsApp’s privacy policy: whatsapp.com/legal/privacy-policy.

The legal basis for providing this contact method is our legitimate interest in a fast, uncomplicated means of communication (Art. 6(1)(f) GDPR). The actual processing of your data within WhatsApp is based on your own, voluntary decision to contact us via this route, and is subject to WhatsApp’s terms of use.

Receiving Email via Google (Gmail) and Processing in Egypt

Enquiries you send via the email route arrive in a mailbox with Google (Gmail, basanttours@gmail.com). Google may process personal data outside the EU/EEA in doing so, including in the USA. The current transfer basis is the European Commission’s adequacy decision on the EU-US Data Privacy Framework of 10 July 2023, for which Google is certified. Further and always up-to-date information can be found in Google’s privacy policy: policies.google.com/privacy.

Separately from this, the controller for your enquiry — Basant Tours Limousinen Service — is itself based in Egypt; the final handling of your enquiry therefore takes place at Basant Tours’ place of business in Egypt. Because you contact us directly on your own initiative in doing so, this does not constitute a transfer within the meaning of Chapter V GDPR by an EU-based controller to a separate recipient — Basant Tours Limousinen Service, as the recipient of your enquiry, is itself already directly bound by the GDPR under Art. 3(2) GDPR (see “Scope” above). There is currently no adequacy decision from the European Commission for Egypt; however, based on the foregoing, this does not affect this direct communication between you and us.

Cookies and Tracking

This website does not use cookies, analytics tools (e.g. no Google Analytics), marketing or tracking services, social media plug-ins, or external embeds such as maps or videos. Other than the server log files that technically arise from the page request itself (see “Hosting”), your browser therefore does not store any information on your device. For this reason, we deliberately do not use a cookie/consent banner — there is nothing here for which we would need your consent under § 25 TDDDG or Art. 6(1)(a) GDPR. Should this change in the future because we introduce new services requiring consent, we will actively ask for your permission beforehand.

Google Fonts (Hosted Locally)

For the consistent display of fonts, we use the fonts “Cormorant Garamond” and “Manrope” from the Google Fonts project. These are embedded locally when the website is built and delivered by our own server — when you access the website, no connection to Google’s servers is made, so no data is transmitted to Google either.

SSL/TLS Encryption

For security reasons and to protect the transmission of confidential content, such as enquiries you send to us via our forms, this site uses SSL or TLS encryption. You can recognize an encrypted connection by the fact that the address line of your browser changes from “http://” to “https://” and by the lock symbol in your browser address bar. We also use server-side measures against automated abuse of our forms (including a request limit per sender, a form field invisible to humans for bot detection, and a limit on request size). We cannot, however, guarantee complete security of data transmission over the internet.

Retention Period

As different data arises in different places, no single retention period applies:

  • Server log files at All-Inkl: according to All-Inkl, seven days at the latest, except in justified individual cases (see “Hosting”).
  • Rate-limiting identifier (hashed IP): a maximum of ten minutes, then automatically discarded.
  • Form data on the web server itself: not stored, only processed for immediate forwarding (see “Forms”).
  • Emails in our Gmail mailbox: remain there until we delete them or the purpose of processing no longer applies; there is no fixed, automatic deletion period for this, as it is our actively managed business correspondence.
  • WhatsApp messages: remain according to your own and our WhatsApp account management, not according to a period set by us.
  • Statutory retention obligations (e.g. for business records) remain unaffected by the above periods.

Your Rights

To the extent the GDPR applies to the relevant processing (see “Scope” above), you have, within the scope of the applicable statutory provisions, the right to free information about your personal data stored by us, its origin and recipients, and the purpose of the data processing, as well as to rectification, erasure and restriction of processing, to data portability, to object to processing based on legitimate interest (Art. 21 GDPR), and — where you have given consent — to withdraw it at any time with effect for the future. For this, as well as for further questions on the subject of data protection, you may contact us at any time using the contact address given above.

Right to lodge a complaint with a supervisory authority: You have the right under Art. 77 GDPR to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, your place of work, or the place of the alleged infringement.

Currency and Changes to This Privacy Policy

This privacy policy was last prepared in August 2026 based on the legal situation current at that time, as well as the then-current official privacy information published by All-Inkl, Google and WhatsApp. As the legal situation and the offerings of the services named above may change, it may become necessary to update this privacy policy.

This Privacy Policy is an English translation of the German Datenschutzerklärung. In case of discrepancies, the German version shall prevail.