Last updated: March 2026
destinationlab (operated by destinationlab GmbH) is the data controller for personal data processed through the platform. We determine the purposes and means of processing your data in accordance with the EU General Data Protection Regulation (GDPR) and applicable national data protection laws. As a data controller, we are responsible for ensuring that your personal data is processed lawfully, fairly, and transparently.
We collect and process the following categories of personal data: • Account Information: Name, email, company name • Usage Data: Feature usage, login activity • Billing Data: Payment method, invoicing details • Traveler Data: Processed on behalf of our customers as a data processor • Technical Data: IP address, browser type, device information
We process personal data based on: • Contractual Necessity (Art. 6(1)(b) GDPR): To provide our SaaS services • Legitimate Interests (Art. 6(1)(f) GDPR): To improve our platform, prevent fraud, and ensure security • Legal Obligations (Art. 6(1)(c) GDPR): Tax, accounting, and regulatory requirements • Consent (Art. 6(1)(a) GDPR): For marketing communications and optional analytics — you can withdraw consent at any time
As a data subject, you have the right to: • Access your personal data (Art. 15) • Rectify inaccurate data (Art. 16) • Erase your data — right to be forgotten (Art. 17) • Restrict processing (Art. 18) • Data portability (Art. 20) • Object to processing (Art. 21) • Withdraw consent at any time (Art. 7) To exercise these rights, contact our Data Protection Officer at privacy@destinationlab.io.
All data is stored in EU-based data centers (Frankfurt, Germany) operated by our infrastructure provider. We implement industry-standard security measures: • Encryption at rest (AES-256) and in transit (TLS 1.3) • Role-based access controls • Regular security audits • Automated backup and disaster recovery • SOC 2 Type II compliance
When data is transferred outside the European Economic Area, we ensure appropriate safeguards are in place: • Standard Contractual Clauses (SCCs) approved by the European Commission • Adequacy decisions where applicable • Supplementary security measures as needed
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected: • Account data: Duration of the customer relationship plus 30 days • Billing records: 10 years (as required by law) • Usage logs: Anonymized after 90 days • Support correspondence: 2 years after resolution After the retention period, data is securely deleted or anonymized.
We use strictly necessary cookies for platform functionality and optional analytics cookies (only with your consent). You can manage cookie preferences at any time through the cookie banner or your account settings. We do not sell personal data to third parties or use your data for automated decision-making or profiling.
For data protection inquiries or to exercise your rights, contact our DPO: Email: privacy@destinationlab.io Address: destinationlab GmbH, Attn: Data Protection Officer, Berlin, Germany You also have the right to lodge a complaint with your local data protection supervisory authority.
Start your 14-day free trial today. No credit card required. Full access to all features.