Privacy Policy

The controller responsible for processing personal data on this website is:

This policy applies to The Real Escape at www.therealescape.xyz.

When you open the website, technical information is necessarily transmitted by your browser. This may include your IP address, the requested URL, date and time, referrer, browser and device information, operating system, response status, and the amount of data transferred.

We process this information to deliver the website, maintain availability and security, diagnose faults, and prevent misuse. The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are the secure and reliable operation of the website.

The website is hosted by Vercel Inc. Vercel may process technical request and log data on our behalf. Logs are kept only for as long as required for delivery, security, troubleshooting, contractual obligations, or applicable legal requirements.

More information is available in Vercel's privacy policy.

We use Vercel Web Analytics to understand aggregate website usage. According to Vercel, the service does not use third-party cookies, does not create a persistent cross-website identifier, and reports anonymous, aggregated information such as page views, referrers, broad location, device type, browser, and operating system.

Vercel uses a daily visitor hash for aggregate measurement; it is not designed to identify you across different days or websites. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is understanding whether the website works and which public pages are useful.

Details are described in Vercel's Web Analytics privacy documentation.

We store your analytics choice locally in your browser under the key tre-analytics-consent-v1. The value is either accepted or rejected. It is not sent to our server and is used only to remember your choice.

This storage is technically necessary to provide the consent setting you selected. The legal basis is Section 25(2) TDDDG and Article 6(1)(f) GDPR.

We use Google Analytics 4, provided in Europe by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Our measurement ID is G-JD2P4FRXJ5.

Google Analytics is not loaded until you actively choose “Accept analytics.” The legal bases are your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw that consent at any time through “Privacy choices” in the footer. Withdrawal does not affect processing that took place before it.

After consent, Google Analytics may process page paths, page titles, referrers, timestamps, browser and device information, approximate location, and client or session identifiers. Google states that IP addresses are used at collection time to derive location information and discarded before the data is logged.

Google Analytics may set first-party cookies such as _ga and _ga_*. These cookies are used to distinguish browsers and sessions and can remain for up to two years unless you delete them or withdraw consent. When consent is withdrawn through our privacy control, we disable analytics and attempt to remove these cookies from this domain.

Advertising storage, ad user data, and ad personalisation remain disabled. Google Signals and advertising personalisation signals are also disabled in our configuration. We do not send names, email addresses, contact messages, or newsletter form contents to Google Analytics.

User-level and event-level data retention in our Google Analytics property is set to two months, and the retention period is not reset by new activity. Google notes that this setting does not apply to standard aggregated reports, which may remain available for longer.

Google may process data in countries outside the European Economic Area. Depending on the processing path, Google uses recognised transfer mechanisms such as adequacy decisions, the EU–US Data Privacy Framework, or standard contractual clauses.

More information is available in Google's privacy policy.

If you contact us, we process the details you provide, such as your name, email address, subject, and message, together with technical delivery information needed to send and protect the form.

We use this information to answer your enquiry. The legal basis is Article 6(1)(b) GDPR where your message concerns a contract or steps before a contract, and otherwise Article 6(1)(f) GDPR based on our legitimate interest in responding to enquiries.

Contact emails are delivered through Resend, a service of Plus Five Five, Inc. We retain correspondence for as long as needed to handle the enquiry and any follow-up, and afterwards only where statutory record-keeping duties or the establishment, exercise, or defence of legal claims require it.

When you subscribe to The Escape Letter, we process your email address and confirmation status. We use a double opt-in process: your subscription is activated only after you open the confirmation link sent to the address you entered.

The legal basis is your consent under Article 6(1)(a) GDPR. You can withdraw at any time using an unsubscribe option in a newsletter or by emailing travel@paularyo.com. We retain the subscription while it is active and may keep limited evidence of consent or withdrawal where necessary to meet legal obligations or defend legal claims.

Resend processes newsletter delivery and subscriber records on our behalf. We do not sell subscriber data.

We use Resend, provided by Plus Five Five, Inc., for contact emails, automatic replies, newsletter confirmation, and future newsletter delivery. Depending on the message, Resend may process email addresses, sender and recipient metadata, message content, delivery status, timestamps, and technical data used for security and deliverability.

Processing is based on the same legal basis as the underlying communication: Article 6(1)(b), Article 6(1)(f), or Article 6(1)(a) GDPR. Resend may process data in the United States and uses contractual and other lawful transfer safeguards.

See Resend's privacy policy.

We use Sanity to manage and deliver editorial content and media. Depending on the requested content or asset, Sanity and its delivery infrastructure may process technical request information required to provide the content securely and reliably.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is operating a secure editorial content management and delivery system. Sanity AS is based in Norway, which is part of the European Economic Area; affiliated infrastructure and subprocessors may also operate in other countries under appropriate safeguards.

See Sanity's privacy policy.

The website may link to hotels, booking services, cafés, publications, social platforms, and other third-party websites. When you follow an external link, the receiving provider processes data under its own privacy policy.

Some links may be affiliate links. If analytics consent is active, we may record a non-identifying event indicating that an affiliate link was selected. We do not attach contact form data or newsletter content to that event.

Personal data is shared only where needed to operate the website, provide a requested communication, meet legal obligations, or protect legal rights. Relevant recipients may include Vercel, Google, Resend, Sanity, professional advisers, and public authorities where legally required.

Where data is processed outside the European Economic Area, we rely on an applicable adequacy decision, the EU–US Data Privacy Framework where available, standard contractual clauses, or another lawful transfer mechanism. No transfer mechanism can eliminate every risk associated with access by authorities in a third country.

Subject to the conditions of the GDPR, you may have the right to access, rectify, erase, or restrict your personal data; to receive data you provided in a portable format; to object to processing based on legitimate interests; and to withdraw consent at any time.

To exercise a right, contact travel@paularyo.com. We may need information reasonably necessary to verify your identity.

You also have the right to lodge a complaint with a data protection supervisory authority. For a controller based in Saxony, the competent authority is generally the Saxon Data Protection and Transparency Commissioner.

The website uses encrypted HTTPS connections. We apply reasonable technical and organisational measures intended to protect data against accidental loss, unauthorised access, alteration, or disclosure.

We may update this policy when the website, providers, legal requirements, or processing activities change. The date at the top identifies the current version.