Privacy Policy

Last updated: 9 October 2026 · Deutsche Fassung: Datenschutzerklärung

1. Controller

Avocado Venture GmbH
Tarnowitzer Str. 6 B
81929 München (Munich), Germany
Managing director: Ralf Aigner
Amtsgericht München, HRB 251670
Email: cris@siennaseasons.com
Contact form: section "Contact"

Sienna Seasons is offered by Avocado Venture GmbH. We have not appointed a data protection officer, as the statutory requirements for doing so (Art. 37 GDPR, Section 38 BDSG) are not currently met.

2. Overview

This website is a static site. Fonts, images and videos are hosted on our own web space; the site does not load fonts, scripts, videos or other content from third-party providers such as Google Fonts, YouTube or social media networks. We process personal data when you visit the site (hosting), when you use one of our forms or email us, and, if you came via one of our ads and send an enquiry, for measuring our advertising (Google click ID, section 8). The website does not set cookies.

3. Hosting with Netlify and server log files

This website is hosted by Netlify, Inc., San Francisco, USA. When you access the site, Netlify processes technically necessary data, in particular your IP address, date and time of access, the page requested, referrer URL, browser type and operating system (server log files). This is required to deliver the website and to keep it stable and secure. We do not merge this data with other data.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and reliable provision of the website. We have a data processing agreement with Netlify pursuant to Art. 28 GDPR (Netlify Data Processing Agreement, incorporated into Netlify's terms). Netlify, Inc. is certified under the EU-U.S. Data Privacy Framework; transfers to the USA are based on the European Commission's adequacy decision (Art. 45 GDPR). In addition, the Netlify Data Processing Agreement incorporates the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914). According to Netlify's Data Processing Agreement, log data is kept for up to 90 days and then deleted or archived in accordance with Netlify's retention rules. More information: netlify.com/privacy.

4. Forms on this website (Netlify Forms)

This website uses three forms. All of them are processed by the Netlify Forms service; submissions are transmitted in encrypted form (HTTPS) and stored on Netlify's servers in the USA (see section 3 for the legal basis of the transfer). To prevent spam, a hidden field ("honeypot") must remain empty, and Netlify automatically checks every submission with the spam filter service Akismet (Automattic Inc., USA); for this purpose the content of the submission and technical data (such as IP address and browser identifier) may be evaluated. Legal basis for spam protection: Art. 6(1)(f) GDPR, our legitimate interest in protecting the forms against abuse.

• "personalise" (Book a free 20-minute call with Cris / Personalise your next travel experience): name, email address, phone number (optional), preferred travel dates, Collection of interest, who is travelling, budget range and your message. Purpose: to contact you, arrange the free call and prepare a travel proposal. Legal basis: Art. 6(1)(b) GDPR (steps prior to entering into a contract at your request) and Art. 6(1)(f) GDPR (our legitimate interest in responding to enquiries). We do not use this data for advertising.
• "waitlist" (Waiting list): email address. Purpose: to inform you when the next Collection opens and to send you a short welcome email. Legal basis: your consent, Art. 6(1)(a) GDPR, confirmed by double opt-in (see section 5).
• "newsletter" (Be the first to know): email address. Purpose: updates on new experiences and Travel Collection drops by email. Legal basis: your consent, Art. 6(1)(a) GDPR, confirmed by double opt-in (see section 5).

You can withdraw your consent to the waiting list or newsletter at any time with effect for the future, using the unsubscribe link contained in every email or by a short message to us; we will then remove your email address from these lists. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Transfer to Brevo (Netlify Function): after a submission, a small program run by Netlify on our behalf (Netlify Function, executed on Netlify's infrastructure in the USA) passes the data to our email service provider Brevo (section 5). The same legal bases as for the form apply; for the transfer to the USA see section 3.

Email notification: each submission is forwarded by email to the people who handle it: Cristina Amezcua (Sienna Seasons) and Ralf Aigner (managing director of Avocado Venture GmbH). They use the data only for the purpose stated above. The notification passes through the email providers of the recipients (for example Google for Gmail addresses); this may involve a transfer to the USA, for which Google LLC is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR).

Storage period: we delete enquiries that do not lead to a booking no later than 12 months after our last contact, including the copies in Netlify, Brevo and the notification emails. Waiting list and newsletter addresses are stored until you withdraw your consent or we discontinue the list. Data from a booking is stored for as long as necessary to perform the contract and to comply with statutory retention obligations (in particular under commercial and tax law, up to 10 years).

Providing the data is voluntary. Without the mandatory fields, however, we cannot process your request.

5. Email service provider Brevo, double opt-in

To manage our waiting list, our newsletter and enquiries, we use Brevo, a service of Brevo GmbH (formerly Sendinblue GmbH), Köpenicker Str. 126, 10179 Berlin, Germany. Brevo processes the data on our behalf under a data processing agreement pursuant to Art. 28 GDPR, which forms part of Brevo's terms of use. According to Brevo, the data is stored on servers within the European Union. More information: brevo.com/legal/privacypolicy.

Waiting list and newsletter: after you submit the form, your email address and the source of your sign-up are transferred to Brevo, and you receive an email asking you to confirm your sign-up (double opt-in). Only after you click the confirmation link is your address added to the list. We store the time of sign-up and confirmation to be able to prove your consent. Legal basis: your consent, Art. 6(1)(a) GDPR. Every email contains an unsubscribe link; you can withdraw your consent at any time with effect for the future. Our emails may contain technical means that show us whether an email was opened and which links were clicked; this is covered by your consent and ends when you unsubscribe. Unconfirmed sign-ups are not added to our lists.

Enquiries: the details you enter in the "personalise" form (name, email address, phone number if provided, preferred travel dates, Collection of interest, who is travelling and budget range) are also stored in Brevo in a separate list for enquiries, so that we can handle your enquiry in an organised way. We do not use this list for advertising emails. Legal basis: Art. 6(1)(b) and (f) GDPR. The storage periods in section 4 apply.

6. Contact by email

If you email us, we process your details to handle your enquiry on the basis of Art. 6(1)(b) or (f) GDPR. Section 4 applies accordingly with regard to storage period and recipients.

7. No cookies, no analytics tools

This website does not set cookies, does not use analytics or tracking tools and stores nothing on your device (no local storage). A consent banner is therefore not needed.

8. Measuring the success of Google Ads (Google click ID)

We advertise with Google Ads. If you reach our website via an ad, Google adds a click ID (gclid) to the address and we may add campaign parameters (utm_source, utm_medium, utm_campaign, utm_content, utm_term). If you send us an enquiry, the form reads these values from the address bar only and sends them, together with the page you visited (landing_path), with your enquiry. Nothing is stored on your device for this and no Google script is loaded.

To measure which ads lead to enquiries, we manually upload the click ID and the time of the enquiry to our Google Ads account (conversion "Sienna Anfrage"). We do not transfer your name, email address or other contact details. Uploads only take place within 90 days of the ad click. The recipient is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; a transfer to Google LLC in the USA is possible, which is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR).

Legal basis: our legitimate interest in measuring and managing our advertising efficiently, Art. 6(1)(f) GDPR. You can object at any time (see section 10); we will then not transfer the click ID of your enquiry.

Storage period: we store the click ID and campaign parameters together with your enquiry (see section 4).

9. Recipients and transfers to third countries

Recipients of personal data are the service providers named above (Netlify, Akismet via Netlify, Brevo, the email providers of the notification recipients and Google, see section 8) and the people at Sienna Seasons who handle your request. Transfers to the USA take place when using Netlify (including Netlify Functions and Akismet) and, with your consent, Google; they are based on the adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR) for certified companies and, where applicable, on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). We do not sell personal data.

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw any consent given with effect for the future (Art. 7(3)). An informal message to cris@siennaseasons.com or via the contact form is sufficient.

Right to lodge a complaint (Art. 77 GDPR): you may lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

11. Automated decision-making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

12. Changes

We will update this privacy policy if the website or the legal situation changes, in particular before activating further services. In case of doubt, the German version (Datenschutzerklärung) prevails.