Regenerative Travel

Privacy Policy

Effective date: August 6, 2026

1. Who is responsible for your data (Controller)

The controller responsible for personal data processed on this website is:

Stephan Christopher Kuehn
Achlada Maleviziou 157
715 00 Heraklion, Crete
Greece
Email: me [at] stevenkeen [dot] com

A Data Protection Officer is not required for a website of this nature and has not been appointed. You can contact the controller directly at the address above on any data-protection matter.

2. Scope

This policy applies to personal data processed through this website, regenerativetravel.org. Other websites have their own privacy policies.

3. What data we collect, why, and on what legal basis

a) Newsletter (your email address). If you subscribe to our newsletter, we collect your email address in order to send you updates about regenerative tourism. Alongside it we store three pieces of context, and nothing else: the language you subscribed in, which of our websites you subscribed from, and whether you arrived through one of our free downloadable guides. We use them only to send the letter in the right language and to know which resource brought you here—never to profile you. We use a double opt-in process—you will receive a confirmation email and must confirm before being added. Our newsletter provider also records standard delivery statistics—whether a letter was opened and which links were clicked—which we look at only in aggregate, to judge whether the letters are worth your inbox; we do not use them to build individual profiles. As proof of your consent, our newsletter provider records the date, time, and IP address of that confirmation.
Legal basis: your consent (Article 6(1)(a) GDPR). You may withdraw consent at any time (see §8 and the unsubscribe link in every email); withdrawal does not affect processing carried out beforehand.

b) Server log files (technical access data). When you visit the site, our hosting and security providers automatically process technical data such as your IP address, browser and device type, the pages requested, and the date and time of access. This is necessary to deliver the website reliably and to protect it against attacks and misuse.
Legal basis: our legitimate interest in the secure and stable operation of the website (Article 6(1)(f) GDPR).

c) Website analytics (Umami). We use Umami, a privacy-friendly analytics tool that we host ourselves, to understand aggregate visitor traffic—such as page views, the websites that referred you, and your approximate location, resolved no more precisely than country level. Umami sets no cookies and stores no IP address, no name, no email address and no account. To tell one visit apart from another it derives a short hash from your IP address, your browser string and this site’s identifier, mixed with a secret salt that Umami rotates on a schedule—monthly for sessions, hourly for individual visits. That hash cannot be turned back into your IP address, and once the salt has rotated it can no longer be matched to a later one; but for as long as a salt lasts it does tell one reader from another, so we treat it as personal data and give it a retention period (see §7) rather than call it anonymous. Our embeddable widgets (the diagrams other websites may place in an iframe) report anonymous, cookieless load counts to a separate property on the same self-hosted Umami installation described above, used only to count how many websites display our graphics; they set no cookies and collect no personal data.
Legal basis: our legitimate interest in understanding how our content is used so that we can improve it (Article 6(1)(f) GDPR). Our analytics store nothing on your device, so no consent is required for them. To opt out, switch on Do Not Track or Global Privacy Control in your browser: we stop counting you immediately, here and on every other site we run.

d) Contact by email. If you email us, we process your email address and the contents of your message solely to reply to you, and for no other purpose.
Legal basis: our legitimate interest in answering inquiries (Article 6(1)(f) GDPR)—or, where your message aims at a contract, Article 6(1)(b) GDPR. Correspondence is deleted once the matter is closed, unless a statutory retention duty applies.

4. Cookies

This site sets no cookies of its own. Your light or dark mode choice is kept for the duration of your visit and discarded when you close the tab; our analytics use no cookies. Cloudflare, which routes and protects this site, may set a strictly necessary security cookie to separate trusted visitors from malicious traffic. None of this requires consent, so there is no cookie banner. We do not use advertising cookies. If you reach the site through a campaign link, its parameters (so-called UTM tags) appear in the page address and are used only as anonymous, cookieless context attached to the aggregate visit statistics described in §3(c). They are not stored on your device and are not used to identify or profile you.

5. Who we share your data with (recipients/processors)

We do not sell your personal data. We share it only with service providers (“processors”) that help us operate the website and newsletter, each under a data-processing agreement:

  • Newsletter delivery: Mailchimp (The Rocket Science Group LLC)—United States.
  • Website hosting: Mittwald CM Service GmbH & Co. KG—Germany (EU).
  • DNS, content delivery, and security: Cloudflare, Inc.—United States.

Our website analytics run on Umami, which we host ourselves on our own server at Mittwald in Germany (EU)—no third-party analytics company receives your data.

6. International data transfers

Some of our providers are US companies (Mailchimp, Cloudflare), so data may be processed by them. Both are certified under the EU-U.S. Data Privacy Framework, which the European Commission recognizes as providing an adequate level of protection, and both maintain the Commission’s Standard Contractual Clauses as a fallback safeguard. Our hosting and our analytics both run on Mittwald’s servers in Germany, with Cloudflare in front as our content-delivery and security layer.

You may request a copy of the relevant safeguards by emailing me [at] stevenkeen [dot] com.

7. How long we keep your data

  • Newsletter email address: until you unsubscribe or ask us to delete it, after which it is removed from our active mailing list without undue delay.
  • Proof of your consent (the date, time, and IP address of your double opt-in confirmation): held by our newsletter provider alongside your subscription record, as evidence that consent was validly given, and deleted together with that record.
  • Newsletter delivery statistics (whether a letter was opened and which links were clicked): held by our newsletter provider alongside your subscription record and deleted together with it; we read them only in aggregate.
  • Server log data (hosting): retained for 60 days, then deleted.
  • Security and delivery log data (Cloudflare): generated and held by Cloudflare, our DNS, content-delivery and security provider, for abuse detection and attack mitigation, and then deleted. Cloudflare sets that period itself and publishes no fixed figure for it, stating only that it keeps such data for a limited period; we do not receive, export or store these logs, so we can neither shorten nor extend it.
  • Analytics data: retained for 24 months, after which the records are deleted or reduced to monthly totals that carry no visitor hash and cannot be traced back to a single visit. The salted hash described in §3(c) stops being usable well before that, as soon as its salt rotates.

8. Your rights

Under the GDPR you have the right to:

  • access the personal data we hold about you (Art. 15);
  • have inaccurate data corrected (Art. 16);
  • have your data erased (Art. 17);
  • restrict processing in certain circumstances (Art. 18);
  • receive your data in a portable format (Art. 20);
  • object to processing based on legitimate interests (Art. 21)—for analytics, switch on Do Not Track or Global Privacy Control and we stop counting you at once; and
  • withdraw consent at any time where processing is based on consent (Art. 7(3)).

Arts. 15-20 apply to data that identifies you, which our analytics counts do not—your right to object always applies.

To exercise any of these, email me [at] stevenkeen [dot] com.

9. Right to lodge a complaint

If you believe your data has been processed unlawfully, you have the right to lodge a complaint with a supervisory authority—in particular in the EU country where you live or work. The authority competent for the controller is:

Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα)
Kifissias Avenue 1-3, 115 23 Athens, Greece—www.dpa.gr

10. Automated decision-making

We do not use your data for automated decision-making or profiling within the meaning of Article 22 GDPR.

11. Changes to this policy

We may update this policy to reflect changes in our practices or the law. The current version is identified by the effective date above.