Privacy Policy
Last updated: 10 August 2026
Dream Urlaub GmbH ("Dream Urlaub", "we", "us" or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose and protect personal data when you visit our website, use our B2B platform, access our API services, make or manage travel bookings, or otherwise interact with us.
Dream Urlaub processes personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and applicable Austrian data protection laws.
1. Data Controller
The data controller responsible for the processing of your personal data is:
Dream Urlaub GmbH
Registered Office: Vienna, Austria
Email: info@dreamurlaub.com
For privacy-related questions, requests concerning your personal data, or the exercise of your rights under the GDPR, please contact us at info@dreamurlaub.com.
2. Personal Data We Collect
Depending on how you interact with Dream Urlaub, we may collect and process the following categories of personal data:
2.1 Company and Contact Information
This may include:
- Full name
- Company name
- Business address
- Email address
- Telephone number
- Job title or professional role
- Account and login information
- Other information provided when communicating with us
2.2 Booking and Travel Information
Where relevant to the provision of our travel services, we may process:
- Booking details and reservation numbers
- Travel dates and destinations
- Hotel, flight and other travel arrangements
- Passenger or traveler information
- Preferences and special booking requirements
- Cancellation and modification information
Where a booking requires information that may constitute special categories of personal data under Article 9 GDPR, such information will only be processed where a lawful basis and applicable exception under the GDPR exists.
2.3 Payment and Billing Information
We may process information necessary to arrange payment and billing, including:
- Billing details
- Invoice information
- Transaction information
- Payment status
- Information required for accounting and reconciliation
Payment card and other payment credentials may be processed directly by our third-party payment service providers. Where payment information is handled by such providers, their own privacy policies may also apply.
2.4 Technical and Usage Information
When you use our website, B2B platform or API services, we may collect technical information such as:
- IP address
- Browser type and version
- Operating system
- Device information
- Date and time of access
- Login and authentication information
- API requests and API logs
- Error logs
- Security and access logs
- Information concerning use of our website or platform
2.5 Information Received from Third Parties
Where permitted by law, we may receive personal data from business partners, travel providers, booking partners, payment providers, customers, or other organizations in connection with providing our services.
Where required by the GDPR, we will provide appropriate information about the source and processing of such personal data.
3. Purposes of Processing
We process personal data for the following purposes:
- Providing access to and operating the Dream Urlaub B2B platform
- Providing travel and booking services
- Creating and administering customer and business accounts
- Processing and managing bookings, reservations, amendments and cancellations
- Processing payments, billing and invoicing
- Communicating with customers, business partners and users
- Providing customer and technical support
- Operating and improving our website, platform and API services
- Maintaining the security, integrity and availability of our systems
- Detecting and preventing fraud, misuse and unauthorized access
- Maintaining technical and operational records
- Complying with applicable legal, tax, accounting and regulatory requirements
- Establishing, exercising or defending legal claims
- Protecting the rights, property and safety of Dream Urlaub, our users and third parties
- Sending marketing communications where permitted by law and, where required, based on consent
We will not process personal data for purposes that are incompatible with the purposes described in this Privacy Policy unless permitted or required by applicable law.
4. Legal Bases for Processing
Depending on the circumstances, Dream Urlaub relies on one or more of the following legal bases under Article 6 GDPR:
4.1 Performance of a Contract — Article 6(1)(b) GDPR
We process personal data where this is necessary to enter into or perform a contract with you or the organization you represent. This includes providing travel services, managing bookings and providing access to our B2B platform.
4.2 Legal Obligations — Article 6(1)(c) GDPR
We may process personal data where processing is necessary to comply with legal obligations, including tax, accounting, financial, regulatory and record-keeping requirements.
4.3 Legitimate Interests — Article 6(1)(f) GDPR
We may process personal data where this is necessary for our legitimate interests or those of a third party, provided that these interests are not overridden by your fundamental rights and freedoms.
Our legitimate interests may include:
- Operating and improving our business and services
- Maintaining IT and platform security
- Preventing fraud and misuse
- Managing business relationships
- Protecting and enforcing legal rights
- Communicating with business customers and partners
- Improving the reliability and performance of our services
4.4 Consent — Article 6(1)(a) GDPR
Where required by law, we will process personal data based on your consent.
You may withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
5. Data Sharing and Recipients
We may disclose personal data where necessary to provide our services, operate our business, comply with legal obligations, or protect our legitimate interests.
Recipients may include:
- Hotels and accommodation providers
- Airlines and other transportation providers
- Travel service providers and suppliers
- Booking and distribution partners
- Payment service providers and financial institutions
- IT, hosting, cloud and infrastructure providers
- Software and technology service providers
- Professional advisers, including legal, accounting and auditing advisers
- Fraud prevention and security service providers
- Government authorities, courts, regulators and law enforcement agencies where legally required or permitted
Where appropriate, we enter into contractual arrangements with service providers that require them to process personal data only in accordance with our instructions and applicable data protection law.
6. International Data Transfers
Where personal data is transferred to a country outside the European Economic Area ("EEA"), Dream Urlaub will take appropriate measures to ensure that the transfer is carried out in accordance with applicable data protection law.
Depending on the circumstances, this may include relying on:
- An adequacy decision adopted by the European Commission;
- Standard Contractual Clauses approved by the European Commission;
- Other legally recognized transfer mechanisms or safeguards.
Where applicable, further information regarding international transfers and the safeguards used may be requested by contacting info@dreamurlaub.com.
7. Data Retention
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including the performance of contracts and compliance with applicable legal obligations.
The specific retention period depends on the type of information and the purpose for which it is processed.
Where applicable, personal data may be retained for longer periods where this is necessary to:
- Comply with statutory retention requirements;
- Establish, exercise or defend legal claims;
- Resolve disputes; or
- Protect our legitimate business interests.
When personal data is no longer required, we will securely delete it or anonymize it where appropriate.
8. Your Rights Under the GDPR
Subject to the applicable legal requirements and limitations, you may have the following rights:
Right of Access
You may request confirmation as to whether we process personal data concerning you and request a copy of that data.
Right to Rectification
You may request correction of inaccurate or incomplete personal data.
Right to Erasure
You may request deletion of your personal data where the applicable legal requirements are met.
Right to Restriction
You may request that we restrict processing of your personal data in certain circumstances.
Right to Object
You may object to certain processing based on our legitimate interests. You may also object to direct marketing at any time.
Right to Data Portability
Where applicable, you may request to receive certain personal data in a structured, commonly used and machine-readable format and to transmit that data to another controller.
Right to Withdraw Consent
Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing performed before withdrawal.
Further information on GDPR rights is available from the European Commission.
To exercise any of these rights, contact:
We may need to request additional information to verify your identity before fulfilling a request. We will generally respond to valid requests without undue delay and, in principle, within one month of receiving the request, subject to the conditions and extensions permitted by the GDPR.
9. Right to Lodge a Complaint
If you believe that the processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with a competent data protection supervisory authority.
For Dream Urlaub GmbH, the competent Austrian supervisory authority may be:
Austrian Data Protection Authority
(Datenschutzbehörde)
Austria
You may also contact another supervisory authority where permitted under the GDPR, for example where you reside or work or where an alleged infringement occurred.
10. Cookies and Similar Technologies
Our website, B2B platform and API-related services may use cookies and similar technologies where necessary for functionality, security, analytics, preferences and other legitimate purposes.
These technologies may include:
- Strictly necessary/session cookies
- Authentication and security cookies
- Preference cookies
- Analytics or performance technologies
- Technical logs and similar technologies
Where consent is legally required for a particular cookie or tracking technology, we will request consent before using it.
You may also control cookies through your browser settings. Disabling certain cookies may affect the functionality or availability of parts of our website or platform.
Where applicable, additional information about cookies and your choices will be provided through our cookie consent mechanism or a separate Cookie Policy.
11. Data Security
Dream Urlaub takes appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or unauthorized access.
Depending on the nature and risks of the processing, these measures may include:
- Encrypted communications, including HTTPS/TLS
- Access controls and authentication mechanisms
- Firewalls and network security measures
- Monitoring and logging of system activity
- Intrusion prevention and security controls
- Role-based access restrictions
- Secure infrastructure and hosting arrangements
- Regular security reviews and audits
- Backup and recovery procedures
- Employee confidentiality and security measures
No method of transmitting or storing information can be guaranteed to be completely secure. However, Dream Urlaub continuously reviews and improves its security measures based on applicable risks and technological developments.
12. Automated Decision-Making and Profiling
Dream Urlaub does not intend to make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you, unless otherwise expressly stated and permitted by applicable law.
If this changes, we will provide the information required by applicable data protection law, including information about the logic involved and the consequences of such processing.
13. Children
Our B2B platform and services are intended primarily for businesses and professional users. We do not knowingly collect personal data directly from children through services intended for business users.
If you believe that a child has provided personal data to us in circumstances where this was not appropriate, please contact us at info@dreamurlaub.com.
14. Third-Party Websites and Services
Our website, platform or communications may contain links to websites, applications or services operated by third parties.
Dream Urlaub is not responsible for the privacy practices or content of third-party websites or services. We recommend reviewing the privacy notices of third parties before providing them with personal data.
Where third-party providers process personal data on our behalf, such processing will be governed by appropriate contractual and data protection arrangements where required by law.
15. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, business practices, technology, or applicable legal requirements.
The updated version will be published on our website with the revised "Last updated" date.
Where required by applicable law, we will provide additional notice of material changes.
16. Contact
If you have any questions about this Privacy Policy or how Dream Urlaub processes personal data, or if you wish to exercise your rights under the GDPR, please contact:
Dream Urlaub GmbH
Vienna, Austria
Email: info@dreamurlaub.com
We will endeavor to handle privacy requests promptly and in accordance with applicable data protection law.