Travel Labs / Privacy notice
Version 1.0 · Updated
Privacy notice
How Travel Labs handles personal data on its website, by email and on Instagram.
In short
- We publish data about prices and services, not about people. We do not sell personal data, show advertising or use cookies.
- Our website has no forms and no accounts. If you email us or contact us on Instagram, we use what you send us to answer you. We do not send marketing emails.
- Our website runs on Cloudflare, a company based in the United States. The section on service providers explains how your data is protected when it leaves the European Economic Area.
- We have an Instagram account. Our website only links to it, so it sends nothing to Instagram unless you click. When you use Instagram, Meta's privacy policy applies. We use AI tools to help us read comments and messages on Instagram and draft replies; a person checks every reply before we send it.
- You can ask us to see, correct or delete your data by writing to hello@travel-labs.nl. You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Who we are
Travel Labs is a travel research lab based in the Netherlands. The Travel Labs website at travel-labs.nl and its projects are published by Travel Labs BV, a Dutch private limited company (besloten vennootschap) registered with the Dutch Chamber of Commerce (KvK) under number 96601442 ("Travel Labs", "we", "us"). We are the controller of the personal data described in this notice.
Privacy questions and requests: hello@travel-labs.nl. We have not appointed a data protection officer because the law does not require one for our activities.
Full company details are in our legal notice.
What this notice covers
This notice applies to the whole Travel Labs website, travel-labs.nl, and to every project published on it, starting with the China Dental Price Index. It also covers email you exchange with us and our Instagram account.
Our website has no forms, member accounts or comment sections at the moment. Before we add a feature that collects personal data, we update this notice and change its version number.
What we collect, why, and on what legal basis
Visiting our website
- Delivering pages and keeping logs: when you visit our website, our hosting provider, Cloudflare, receives your IP address and the technical details your browser sends, such as your browser type and the page you asked for, so that it can deliver the page. Cloudflare keeps short-lived technical logs of requests, such as the address requested, the time and the result, which may include your IP address. We use them only to fix faults and stop abuse. Legal basis: our legitimate interest in running a secure, working website (Article 6(1)(f) GDPR).
- Statistics: we use Cloudflare Web Analytics to count page views, measure how fast our pages load and see which sites refer visitors to us. It uses no cookies or local storage and does not fingerprint visitors; we see only totals. Legal basis: our legitimate interest in knowing how our pages are used (Article 6(1)(f) GDPR).
- No other third parties: we host our fonts and images ourselves, and our pages load no scripts from other companies except Cloudflare Web Analytics. The link to our Instagram account is an ordinary link and loads nothing from Instagram. Loading our pages therefore does not send your IP address to anyone other than Cloudflare.
Email and other contact
- When you write to us at hello@travel-labs.nl, for example about a correction, a licence or a press question, we process your name, email address, message and anything you attach, to answer you. Legal basis: our legitimate interest in answering you (Article 6(1)(f) GDPR) or, for a licence, steps you asked us to take before entering into a contract (Article 6(1)(b) GDPR). Our public corrections log describes what changed, not who told us.
- Health details: please do not send us details about your health or treatment. We do not give medical advice. If you send such details, we do not copy them, and we delete the email once we have replied.
- When we contact you, for example as a journalist, insurer or data partner, we use work contact details that you or your organisation publish for that purpose, and we keep a short record: name, organisation, role, work email and when we were in touch. Legal basis: our legitimate interest in telling relevant people about our data (Article 6(1)(f) GDPR). Tell us to stop and we will.
- Who handles it: our email provider (see the section on service providers).
Our Instagram account
We have an account on Instagram: @travel_labs_official.
- Our website only links to it. The Instagram link on our pages is an ordinary link with an icon stored on our own server. We do not embed posts, load scripts from Instagram or use its tracking pixels, so visiting our website sends nothing to Instagram. Instagram receives data only if you click the link and go to its site or app.
- Instagram's own rules apply. In the European Union, Instagram is provided by Meta Platforms Ireland Limited. Apart from the statistics described below, Meta decides on its own how it processes your data when you use Instagram, including on our account, and the Meta Privacy Policy applies.
- What we process: when you follow us, like, share or comment on our posts, mention or tag us, or send us a direct message, we see what you post or send us, together with your public profile (user name, display name and picture). We use this to run our account: to read and answer comments and messages, and to moderate comments under our house rules (see our terms of use).
- Statistics: Instagram gives us statistics about our account and posts, such as reach, views and interactions, and broad information about our audience, such as location, age group or gender. We see these only as totals and cannot tell who is behind them. For these statistics, we and Meta may be jointly responsible (joint controllers). Meta has published an arrangement for this, the Page Insights Controller Addendum, under which Meta takes primary responsibility for informing you about the statistics and for handling your rights. You can exercise your rights with Meta or with us, and we will pass on any request that only Meta can answer.
- Direct messages: we read and answer them ourselves. If a message needs follow-up, for example a correction, a press question or a licence request, we copy only what we need into our own records and handle it as described under Email and other contact. Please do not send us details about your health or treatment: we do not give medical advice, we do not copy such details, and we delete the conversation from our inbox once we have replied.
- AI tools: we use AI tools to help us read and sort comments and direct messages, and to draft replies. A person checks every reply before we post or send it. To do this, the tools send the comment or message, including your user name and any picture in it, to AI service providers: companies that provide AI language models to businesses. These providers act only on our instructions under a data processing agreement, are not allowed to use your messages to train their AI models, and delete them within 30 days unless they must keep them longer by law or to deal with misuse of their services. Our current AI service providers process data in the United States, and possibly in other countries outside the European Economic Area; the section on service providers explains how this is protected. You can ask us for their names.
- Legal basis: our legitimate interest in telling people about our work, answering people who contact us promptly (with the help of AI tools), and learning which posts are useful (Article 6(1)(f) GDPR).
- How long we keep it: see How long we keep data.
Cookies
We do not use cookies, and our website stores nothing on your device. That is why it shows no cookie banner.
Apart from what is needed to show you our pages, the only thing on our website that reads information from your browser is Cloudflare Web Analytics. Its script reads technical information, such as how long the page took to load, and sends it to Cloudflare to count visits. It stores nothing on your device and does not identify you. Dutch law allows this without consent, because it only measures how well our website works and has little or no impact on your privacy (Article 11.7a(3)(b) of the Telecommunicatiewet).
| What | Where | Purpose | Stored on your device | Consent needed? |
|---|---|---|---|---|
| Cloudflare Web Analytics | All pages | Counts visits and measures page speed | Nothing | No: statistics with little or no impact on your privacy |
If we ever add a cookie, or anything else that stores or reads information on your device, we will update this notice first and, where the law requires it, ask for your consent.
Service providers and transfers outside Europe
We use service providers (processors) that act only on our instructions under a data processing agreement. These are:
| Provider | What it does for us | Where data is stored | How transfers are protected |
|---|---|---|---|
| Cloudflare, Inc. (United States) | Website hosting and network, statistics and request logs | Cloudflare's global network | EU-U.S. Data Privacy Framework (Cloudflare is certified), plus the EU Standard Contractual Clauses in its data processing agreement |
| Our email service provider | Receiving and storing the emails you send us, and sending our replies | Where our email service provider stores email, which may be outside the European Economic Area | If it stores email outside the European Economic Area: the European Commission's Standard Contractual Clauses or, where the provider is certified, the EU-U.S. Data Privacy Framework |
| AI service providers: companies that provide AI language models to businesses (you can ask us for the names of our current providers) | Helping us read and sort comments and messages on our Instagram account and draft replies, which a person checks before we post or send them | In the United States, and possibly in other countries outside the European Economic Area. The providers delete our data within 30 days, unless they must keep it longer by law or to deal with misuse of their services | EU Standard Contractual Clauses in each provider's data processing agreement, or the EU-U.S. Data Privacy Framework where the provider is certified |
The European Commission has decided that the United States ensures adequate protection for transfers to companies certified under the EU-U.S. Data Privacy Framework. For other transfers we rely on the Standard Contractual Clauses adopted by the European Commission. You can ask us for a copy of the relevant safeguards.
Instagram (Meta) is not our service provider. It is responsible for its own processing, as the section on our Instagram account explains.
We do not sell personal data, and we do not share it with anyone else unless the law requires us to.
How we protect your data
We collect as little as we can. We use encrypted connections everywhere, give access only to the people who need it, and protect our accounts with two-factor authentication. If a breach puts your rights at risk, we will tell the Dutch Data Protection Authority and, where required, you.
How long we keep data
| Data | How long |
|---|---|
| Emails you send us, and our records of contacts, press and partners | 24 months after our last contact, unless you ask us to delete them earlier. Emails with health details are deleted once we have replied |
| Instagram: comments and posts that mention us | They stay on Instagram until their author deletes them, or until we hide or delete them under our house rules |
| Instagram: direct messages in our inbox | We delete conversations 24 months after the last message, or as soon as we have replied if they contain health details. Instagram keeps its own copies under its own rules |
| Instagram: working copies of comments and messages that our AI tools keep on our own computer | As for direct messages (above) |
| Copies held by our AI service providers | Deleted by the provider within 30 days, unless it must keep them longer by law or to deal with misuse of its services |
| Anything we copy out of comments or messages | As for emails and contacts (above) |
| Cloudflare request logs | Up to 7 days |
Your rights
You have the right to:
- see the personal data we hold about you and get a copy;
- have it corrected or deleted;
- restrict how we use it;
- receive data you gave us in a machine-readable format, where the law gives you this right;
- object at any time to our use of your data based on our legitimate interests. For contact lists, we will always stop.
Write to hello@travel-labs.nl. We answer within one month. We may ask you to confirm your identity.
We do not make decisions about you based solely on automated processing.
Complaints
If you are unhappy with how we handle your data, please tell us first so we can try to fix it. You also have the right to complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), Postbus 93374, 2509 AJ Den Haag, the Netherlands, through its website autoriteitpersoonsgegevens.nl. If you live in another EU country, you can also complain to the data protection authority there.
Children
Our website and our Instagram account are not aimed at children under 16.
Changes to this notice
We review this notice whenever we add a feature or a project that uses personal data, open a social media account or change a service provider. Each version has a number and a date. If a change affects how we use data we already hold, we will tell the people concerned before it takes effect, where we can reach them.
| Version | Date | What changed |
|---|---|---|
| 1.0 | 10 November 2026 | First version, covering the website, email and our Instagram account |