Privacy at a glance

First, the summary

Every page of Kyoto Activities is open without an account. We set no cookies and run no analytics, advertising or tracking scripts. What reaches us is the connection data any web server receives when it delivers a page, set out below.

Nothing is booked on this site. When you pick a tour, the booking happens on GetYourGuide or Viator, under their privacy rules.

Whom to contact

Kyoto Activities
[email protected]

We are not legally required to appoint a data protection officer and have not done so. For any question about your data, write to [email protected].

Records kept by our server

Whenever your browser requests a page or a file, our web server notes the IP address of the request, the date and time, the address asked for, the page that sent you, and the text your browser sends to identify itself and your operating system.

These records let us deliver the site, keep it running, spot attacks and misuse, and count how often each page is read. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in a site that works and stays secure. Raw records are erased after 90 days at most; counts without IP addresses are kept longer. A hosting company runs the server and processes this data for us, only as we instruct.

Between you and our server

Pages and email on this domain are routed through Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA), which serves the site fast, blocks attacks and passes email on to our inbox. For this, Cloudflare processes your IP address and technical connection data.

The legal basis is Article 6(1)(f) GDPR: our interest in a quick and well-protected site. Cloudflare holds certification under the EU-US Data Privacy Framework, with the European Commission's standard contractual clauses applying as well. Its own policy is at cloudflare.com/privacypolicy.

Photos of the activities

Tour photos load directly from GetYourGuide's image servers (GetYourGuide Deutschland GmbH, Sonnenburger Straße 73, 10437 Berlin, Germany). To display one, your browser contacts those servers and sends them your IP address, an exchange we have no control over.

The legal basis is Article 6(1)(f) GDPR: we want each tour shown with the provider's up-to-date photos.

Leaving us to book

A booking link takes you directly to GetYourGuide or Viator. It carries our partner number so the platform knows the booking came through us.

On GetYourGuide or Viator, the platform sets its own cookies and treats your data under its own privacy policy. What we get back are commission reports with totals only, without names, contact details or payment data.

Video players

Videos use YouTube's privacy-enhanced mode and remain a still image until you press play; until then your browser makes no contact with YouTube. Once you press play, the video streams from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), which receives your IP address and may set cookies.

By pressing play you consent: Article 6(1)(a) GDPR and Section 25(1) TDDDG. Google explains its handling here: policies.google.com/privacy.

Saved in your browser

Your browser keeps a handful of small notes so the site remembers your choices. They stay on your device, and we have no way to read them:

• which checklist boxes you ticked, so they stay ticked on your next visit (local storage, kept until you clear it);
• the currency you chose in the menu, so every page keeps showing it (local storage, kept until you clear it);
• for a chat you started: its reference number, an access key, your email address and a copy of what was written, so you can pick it up again (local storage, kept until you clear it);
• that the chat bubble already appeared once, so it stays away (session storage, removed when the tab closes);
• that the offer shown as you leave already appeared once, so it stays away (session storage, removed when the tab closes).

These notes are strictly necessary for features you choose to use (Section 25(2) No. 2 TDDDG). You can delete them at any time in your browser settings.

Our chat window

Starting a chat means giving us your name, your email address and your messages. The chat service also notes which country your connection comes from, a scrambled version of your IP address (a salted hash that cannot be turned back into the address), and the page and language you were using.

Chats are stored with Cloudflare (named above), and each message you send is passed to our account on the Telegram messaging service, which processes it outside the European Union; our replies travel back the same way. Details: telegram.org/privacy. Your email address serves only to answer you.

The legal basis is Article 6(1)(b) GDPR, since you ask and we reply, and Article 6(1)(f) GDPR for the scrambled IP address, used solely to stop abuse and spam. Each conversation is erased automatically 180 days after its last message.

Emails you send us

An email to us is used only to reply to you. The legal basis is Article 6(1)(f) GDPR, plus Article 6(1)(b) GDPR when your message is about a contract. Once the exchange is over we delete it, unless the law obliges us to keep it.

The fonts and the maps

Our fonts come from our own server, so no font service hears about your visit. The maps are images kept on our server and drawn from OpenStreetMap data; viewing or zooming them contacts no map service. A "Google Maps" link reaches Google only if you press it.

Links to our references

Our guides name official and expert sources and link to them. Those sites receive nothing from you until you click a link; after that, their own privacy rules apply.

Your data rights

You can ask what data we hold about you (Article 15 GDPR), have it corrected (Article 16) or deleted (Article 17), have its processing limited (Article 18) and receive it in a portable format (Article 20). Where we rely on legitimate interest you may object at any time (Article 21), and consent you gave can be withdrawn for the future. A message to [email protected] is all it takes.

You may also complain to a data protection supervisory authority, especially in the EU country where you live, work or where you think the infringement happened (Article 77 GDPR).

We take no automated decisions about you and create no profiles. Giving us data is not required, though without technical connection data no page can reach your screen.