Privacy Policy (Datenschutzerklärung) – Pomegranated

4 Nov 2026 · @Flo

1. Controller (Verantwortlicher)

The controller under Art. 4 (7) GDPR for pomegranated.com is Florian Ruci, who operates Pomegranated as a sole proprietorship (Einzelunternehmen).

Address: Langweidenstraße 7, 60488 Frankfurt am Main, Germany
Email: info@pomegranated.com
Phone: +49 176 32237478

We have not appointed a data protection officer because the law does not require one for a business of our size. For any privacy question, write to the email address above.

2. What this policy covers and our legal bases

This policy explains which personal data we process when you visit this website, contact us, join our mailing list or book a tour, and why. Personal data is any information relating to an identified or identifiable person. We do not sell your data and we do not use automated decision-making or profiling.

We rely on these legal bases under Art. 6 (1) GDPR:

Contract (lit. b): handling your booking and questions about it.
Consent (lit. a): the newsletter and any cookies or tools that are not strictly necessary. You can withdraw consent at any time, with effect for the future.
Legal obligation (lit. c): accounting and tax records.
Legitimate interests (lit. f): running and securing the website and answering general inquiries.

3. Hosting and server log files

This website is built and hosted with Wix. When you open a page, Wix's servers process technical data such as your IP address, date and time of access, the pages requested, the referring page, and browser and device information. This is needed to deliver and secure the site (Art. 6 (1) lit. f GDPR).

Wix.com Ltd. (Israel) and its group companies, including Wix.com Inc. (USA), act as our processors under a data processing agreement. Transfers outside the EU rely on the European Commission's adequacy decision for Israel and on EU Standard Contractual Clauses.

4. Cookies and similar technologies

Strictly necessary cookies (for example for security, load balancing and remembering your cookie choice) are set without consent under § 25 (2) No. 2 TDDDG; the processing rests on Art. 6 (1) lit. f GDPR.

All other cookies and similar technologies, such as analytics or content from third parties, are used only after you consent in the cookie banner (§ 25 (1) TDDDG, Art. 6 (1) lit. a GDPR). You can change or withdraw your choice at any time through the cookie settings on this site, or delete cookies in your browser. Withdrawal does not affect processing that took place before.

5. Contacting us: email, phone, contact form, WhatsApp

If you contact us, we process your name, contact details, the content of your message and the time of contact, only to answer you. The legal basis is Art. 6 (1) lit. b GDPR if your question concerns a booking or a planned booking, otherwise Art. 6 (1) lit. f GDPR. Messages sent through the contact form on this site are stored in our Wix account.

We use WhatsApp only to reply to messages you send us first, and never for promotional messages. WhatsApp Ireland Limited and Meta process your phone number and communication metadata under their own privacy policy, even though message content is end-to-end encrypted. If you prefer not to use WhatsApp, contact us by email or phone.

6. Bookings and payments

When you book a tour, we process your name, email address, phone number if you give it, the tour, date, number of participants and your payment details. For private tours with hotel pick-up we also use the pick-up address you give us, only for that purpose. We use this data to confirm and carry out the tour (Art. 6 (1) lit. b GDPR) and to meet tax and accounting duties (Art. 6 (1) lit. c GDPR).

Payments run through the payment providers offered at checkout, such as Wix Payments, PayPal or Stripe, depending on the method you choose. They process your payment data under their own privacy policies; we never see or store your full card number.

If you tell us about mobility or other needs so we can adapt a tour, you do so voluntarily and we use that information only for the tour (Art. 9 (2) lit. a GDPR).

7. Mailing list

If you subscribe to our mailing list, we use your email address, and your name if you give it, to send you news about tours and offers. We do this only with your consent (Art. 6 (1) lit. a GDPR) and use a double opt-in: you receive a confirmation email and are subscribed only after you click the link in it. To prove your consent we store the time of sign-up and confirmation (Art. 6 (1) lit. f GDPR).

Emails are sent through the email tool of our website provider Wix. You can unsubscribe at any time with the link in every email or by writing to us. We then remove you from the list; we may keep your address on a suppression list so that we respect your decision.

8. Social media, reviews, games and external links

The icons for Instagram, YouTube, Facebook, TikTok and WhatsApp, and the link to our TripAdvisor page, are ordinary links, not plugins. No data is sent to these services until you click one. After that, the privacy policy of that service applies, and it may set cookies.

We show short excerpts of public reviews from TripAdvisor, including the first name and country the reviewer chose to publish. If you want a review excerpt removed, write to us.

Our online games, such as the Frankfurt riddles, run on this website. They do not require personal data. If a game ever asks for a name or email address, for example to award a prize, we say so there and use the data only for that purpose.

9. Analytics and Google Search Console

To understand how the site is used, we use the statistics function of our website provider Wix, which shows us aggregated figures such as pages viewed, device type, approximate region and traffic source. Where this needs cookies or similar technologies, it happens only after your consent (§ 25 (1) TDDDG, Art. 6 (1) lit. a GDPR).

Our site is verified with Google Search Console through a meta tag. Search Console shows us aggregated information on how the site appears in Google Search, not personal data of individual visitors.

We do not currently use Google Analytics, advertising pixels or retargeting.

10. Recipients and retention

We pass personal data only to those who need it for the purposes above:

Wix, as hosting, forms and email tool provider
Payment providers, for processing payments and refunds
Our email provider and our tax advisor or accountant
Another guide who leads a booked tour for us, limited to the booking details needed
Authorities, where the law requires it

We delete data when it is no longer needed for its purpose, unless a legal retention period applies:

Data

Retention

Booking confirmations, invoices, accounting records

8 years from the end of the year (§ 147 AO, § 257 HGB)

Business emails and messages about a booking

6 years from the end of the year (§ 257 HGB)

General inquiries without a booking

Up to 6 months after the inquiry is resolved

Mailing list address

Until you unsubscribe

11. Your rights and the supervisory authority

You have the right to:

access your data (Art. 15 GDPR)
have it corrected (Art. 16)
have it erased (Art. 17)
restrict its processing (Art. 18)
receive it in a portable format (Art. 20)
withdraw consent at any time (Art. 7 (3))

You may object at any time to processing based on legitimate interests (Art. 21 GDPR), for reasons arising from your particular situation. You may object at any time, without giving reasons, to the use of your data for direct marketing. To use any of these rights, email info@pomegranated.com.

Providing the data needed for a booking is required to carry out the booking; without it we cannot confirm a tour.

You can also complain to a data protection authority. The one responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit), Postfach 3163, 65021 Wiesbaden, Germany.

12. Changes to this policy

We update this policy when our services or the law change. The current version is always on this page. Last updated: 4 November 2026.