Privacy policy

This policy describes only what the site actually does, after a code inspection on 12 November 2026 and an update on 13 November 2026 when the site went live. Placeholders are clearly marked.

1. Controller

The controller (Art. 4(7) and Art. 13 GDPR) is:

Kluger Rabe GmbH
Krenngasse 12
8010 Graz
Austria

Company register: Firmenbuch FN 692322 x, Landesgericht für Zivilrechtssachen Graz
Email: [email protected]

No data protection officer has been appointed (the appointment duty under Art. 37 GDPR / § 5 of the Austrian Data Protection Act is not met for this company).

2. What this website actually does

Ancient Mystery Tours (ancientmysterytours.com) is a static website built with Astro. It is a tour directory and editorial site. It has no user accounts, no server-side form backend, and no payment processing. Bookings take place only on the tour operators’ own websites.

The findings below are from inspection of the site’s layouts, pages, components, public assets and build config on 12 November 2026.

2.1 Hosting and server logs

The site is hosted on Cloudflare Pages, a service of:

Cloudflare, Inc.
101 Townsend St
San Francisco, CA 94107
USA

Address verified on 12 November 2026 on Cloudflare’s about page (cloudflare.com/about) and privacy policy (cloudflare.com/privacypolicy). The same street address appears in Cloudflare’s SEC filings.

When you visit the site, Cloudflare processes technical data in order to deliver the pages, keep the service available and protect it against abuse and attacks. That data typically includes your IP address, the date and time, the requested URL, the referrer, the user agent (browser and device) and the HTTP status code. Cloudflare states that this metadata contains extremely limited personal data, most often in the form of IP addresses, and is processed on behalf of the customer in data centres in the United States and Europe for a limited period (Cloudflare GDPR FAQs, checked 12 November 2026). Cloudflare does not publish a single fixed retention number for those request logs in the sources we checked; we therefore do not state a number here.

Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in operating, securing and making the website available.

Cloudflare acts as our processor (Art. 28 GDPR). The contract is the Cloudflare Data Processing Addendum (DPA), Version 6.4, effective 3 April 2026, which forms part of Cloudflare’s Main Agreement, including the Self-Serve Subscription Agreement (the terms that apply to a free-plan account).

Transfers outside the EEA. Cloudflare is a US company, and some processing takes place in the United States. We rely on the following, both verified on 12 November 2026:

Cloudflare, Inc. holds an active certification under the EU-U.S. Data Privacy Framework, as well as the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF. Official list entry: dataprivacyframework.gov/participant/5666 (status: Active; original EU-U.S. certification 9 November 2016; next certification due 15 September 2027; covers HR and non-HR data). Clause 6.4 of Cloudflare’s DPA states that transfers of customer data to Cloudflare under the Data Privacy Framework are not “Restricted Transfers”, and that if the certification lapses the Standard Contractual Clauses in the same DPA apply.
As a further safeguard, the same DPA incorporates the EU Standard Contractual Clauses (European Commission Implementing Decision 2021/914 of 4 June 2021) for Restricted Transfers from the EEA, with the UK Addendum and Swiss adaptations where those laws apply (DPA clause 6). See cloudflare.com/cloudflare-customer-dpa.

2.2 Cookies, local storage and a cookie banner

Our own pages do not set cookies and do not use localStorage, sessionStorage or similar browser storage. There are no advertising pixels, no third-party widgets and no consent-management script. The only measurement on the site is Cloudflare Web Analytics, described in section 2.3, which according to Cloudflare does not use cookies or local storage. That is why this site has no cookie banner.

Cloudflare Pages, used as a static host, does not itself require cookies. Cloudflare’s documentation lists cookies only for optional security and traffic features (for example Bot Management or a challenge page: __cf_bm, cf_clearance). Those features are not part of our planned default setup. If they were later enabled, the cookies would be strictly necessary for the security service and would be listed here first. Source: Cloudflare Cookies (docs updated 10 November 2026; checked 12 November 2026).

Under § 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021), a consent banner is required only if we store or read information on your device that is not strictly necessary. In the site’s current and planned form, a cookie banner is not required. If that changes (for example embeds or non-essential cookies), this policy will be updated and, where the law requires it, a banner or a click-to-load pattern will be added before those features go live.

2.3 Analytics

The site uses Cloudflare Web Analytics, a service of Cloudflare, Inc., already named as host and processor under the DPA in section 2.1. Cloudflare injects the measurement beacon automatically on the Pages project; we do not add the script ourselves, and we do not use Google Analytics or any other tracker.

According to Cloudflare’s documentation (checked 13 November 2026: Web Analytics docs, FAQ, and the product page at cloudflare.com/web-analytics), the beacon does not use cookies or local storage to collect metrics, does not store or access cookies, localStorage, sessionStorage or IndexedDB, and does not fingerprint visitors by IP address, user-agent or other data. It collects ephemeral page-view and performance data from the browser’s Performance API for the current page. Cloudflare states that it does not track individual visitors across its customers’ sites, and that although the beacon request includes an IP address as part of ordinary HTTP handling, that address is discarded at the nearest data centre and is not stored in Cloudflare’s core databases or logs. Cloudflare receives the aggregated page-view and performance data.

Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in understanding, in aggregate, how the website is used and how it performs. Because this measurement does not use cookies or local storage and does not build personal profiles, it is also why there is no cookie banner (see section 2.2).

2.4 Fonts, images and third-party resources

Fonts are system fonts only (Georgia, “Times New Roman”, system-ui). The site does not load Google Fonts or any other third-party font or script CDN.
Images are stored and served with the site itself (processed at build time). They are mainly photographs from Wikimedia Commons under free licences; credits are on each image and on the Image credits page.
The site’s own source does not load other third-party scripts. The only exception is the Cloudflare Web Analytics beacon, which Cloudflare injects automatically when it delivers the pages (see section 2.3).

2.5 Embeds and outbound links

The site does not embed third-party content: there are no YouTube or Vimeo iframes, no Google Maps, no booking widgets (GetYourGuide, Viator, WeTravel or similar) and no social-media embeds. Links to YouTube channels, podcasts, operator sites, research sources and Wikimedia are ordinary outbound links. If you follow them, those sites are responsible for their own data processing; their own privacy policies apply.

2.6 “List your tour” form

The form on List your tour has no server-side backend. Submitting it opens your own email application with a pre-filled message. Nothing is sent to us until you send the email yourself.

If you do send it, we process the content (operator and contact details, tour facts) in order to consider a listing, on the basis of Art. 6(1)(b) GDPR (steps at your request before a possible listing arrangement) and/or Art. 6(1)(f) GDPR (operating the directory). We keep such emails as long as needed to handle the request and to meet any legal retention duties.

2.7 Tour search

The search and filter controls on the site only navigate to pages or query parameters on this website. They do not send personal data to a third party. Those requests may appear in the host’s server logs (see 2.1).

2.8 Affiliate links

The site currently uses ordinary links to operators’ own websites. Tracked affiliate links are not yet implemented. Planned programmes (not signed up) include GetYourGuide (typically a 31-day cookie) and Viator (typically a 30-day cookie). If and when they are used:

we will label those links;
any affiliate cookie is set by the partner on their domain after you click, not by us on ours;
the partner is the controller for that processing; their privacy policy applies.

This section will be updated before tracked affiliate links go live.

2.9 Email you send us

If you write to [email protected], we process your message, your email address and any data you include, in order to reply (Art. 6(1)(b) or (f) GDPR). Correspondence is kept as long as needed to handle the enquiry and to meet legal retention duties (for example commercial-letter retention under the UGB, where it applies).

3. Recipients and transfers outside the EEA

Cloudflare, Inc. (address in section 2.1) is a processor for hosting, delivery, request logs, security and Cloudflare Web Analytics, under the DPA and transfer bases described in section 2.1.

If you email us at [email protected], your message is handled by your email provider and by ours.

4. Retention

Server logs at Cloudflare: for a limited period, as described by Cloudflare (see section 2.1). We could not verify a single published number of days and therefore do not state one.
Cloudflare Web Analytics: Cloudflare states that it retains unsampled beacon data for 7 days and then stores aggregated data; data can be viewed in the dashboard for the previous six months (Cloudflare Web Analytics FAQ, checked 13 November 2026).
Email enquiries and listing submissions: for the time needed to handle them, and longer where a legal duty (for example UGB record-keeping) applies.
We do not run a customer database for travellers.

5. Your rights

Under the GDPR you have the right, within the statutory limits, to:

access your personal data (Art. 15);
rectification (Art. 16);
erasure (Art. 17);
restriction of processing (Art. 18);
data portability (Art. 20);
object to processing based on Art. 6(1)(f) (Art. 21);
withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal (Art. 7(3)).

To exercise these rights, email [email protected].

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). For Austria that is:

Österreichische Datenschutzbehörde
Barichgasse 40–42
1030 Vienna
Austria
https://www.dsb.gv.at

6. Whether you have to give us data; automated decisions

You can use the public pages of this site without giving us personal data (apart from technical data that a future host may log — see 2.1). Sending an email is voluntary. We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

7. Changes to this policy

We will update this policy if our processing changes (for example when affiliate links go live) and will show the date of the latest version here. Material changes will be in place on the site before the new processing starts.

Last updated: 13 November 2026.