Privacy

1. Controller

The controller is City Ticket & Trade. Contact details appear above and in the legal notice.

2. Data we process

• Technical access data needed for secure operation and error analysis, such as time, page requested, browser and device information, and IP address.
• Information in travel and contact forms, including service, route or destination, dates, number of travellers, name, contact details and optional notes.
• Depending on the destination, visa requests may include identity, birth, nationality and passport data; for the Türkiye service, parents' names; and uploaded passport, photo and residence documents. Photos are not used for automated biometric identification.
• Communication data if you contact us by telephone, email or a messenger chosen by you.

3. Purposes and legal bases

We process data to answer requests, take steps before entering into a contract, perform a contract and provide customer support under Article 6(1)(b) GDPR. Security, abuse prevention and reliable website operation rely on Article 6(1)(f) GDPR. Where we ask expressly for consent, Article 6(1)(a) GDPR applies; consent may be withdrawn at any time for the future.

4. Recipients and international travel

Access within City Ticket & Trade is limited to people handling your request. Uploaded visa documents are stored privately and are not made public. Data is shared with airlines, hotels, organisers, ticket providers, authorities or other suppliers only where necessary for the requested offer, a visa process expressly commissioned by you, a booking you have confirmed, or a legal obligation. Hosting and IT providers may act as processors.

• Travel or suppliers outside the European Economic Area may require a third-country transfer. Before a binding disclosure, we identify the recipient and use the legal basis and safeguards required for the transfer where applicable.

5. Retention

Request data is retained only as long as necessary to handle the request, answer follow-up questions and establish, exercise or defend legal claims. If a contract is made, statutory commercial and tax retention rules also apply. Data is then erased or anonymised unless a legal duty or justified need requires further retention.

eSIM requests and email notifications

For an eSIM inquiry we also process destination, requested data allowance and duration, travel date, device model, contact details and optional notes to check compatibility, coverage and an offer. Information needed for provision is shared with the eSIM supplier named in the offer only after your binding instruction.

Automatic confirmations and status updates are sent only if an email provider is configured. The sending provider then processes recipient address, subject, message and delivery status as a processor. Passport details and uploaded documents are not included in message text. Undelivered messages may be held in a protected queue.

Online payments

For fixed online prices and accepted offers, you are redirected to Revolut for eSIM and to Stripe for other payable services. We send the amount and an internal order ID, and your email address to the payment provider. You enter payment details directly with the provider. We retain its order or session ID, amount and confirmed payment status, but no full card number. Cash-payment visa requests receive a tracking code before payment; the amount remains outstanding. eSIM delivery requires server-confirmed payment. The provider's privacy notice applies to its own processing.

Private request area

A confidential randomly generated code lets you view progress, your submitted details, agency messages and available documents. For older short references, a new access code is sent to the email on file. We process the reference, email where needed, technical access data and limited failed attempts to prevent abuse. Document access is time limited and restricted to authorised holders. Contact us if an email address needs correction.

6. Your rights

• Access, rectification, erasure, restriction and data portability where the legal conditions apply.
• Objection to processing based on legitimate interests.
• Withdrawal of consent with effect for the future.
• A complaint to a data-protection authority, in particular the authority responsible for Hamburg.

7. Cookies, analytics and external services

Privacy settings are stored locally in ct-privacy-choice-v1 for 180 days. No optional analytics or advertising is enabled. You can reopen Privacy settings at any time. For eSIM checkout, Revolut receives the amount, order reference and email; we do not store full card details. For a visa request with cash payment at the agency, the tracking code is issued before payment; payment remains outstanding.

This website uses no first-party advertising or marketing trackers. Hosting and access infrastructure may use technically necessary data or cookies. Destination photographs are served locally. External services such as WhatsApp or maps open only after you actively select the relevant link; the provider's privacy rules then apply.