What Palace Legong does with your data

In a sentence

Every page of Palace Legong can be read without an account. The site sets no cookies and runs no analytics, advertising or tracking scripts. What does reach us is the connection data any web server sees when it delivers a page, which is described below.

Nothing is booked on this site. When you pick a ticket or tour you book it on GetYourGuide, and its privacy rules apply there.

Who runs Palace Legong

Palace Legong
[email protected]

We have no legal duty to name a data protection officer, so we have none. Please email [email protected] for any point on how your data is handled.

Records the server keeps

Whenever your browser fetches a page or a file, our web server notes the IP address, the date and time, the address requested, the page you arrived from and the identifier string your browser sends about itself and your operating system.

We need these records to deliver the site, keep it stable, spot attacks and abuse, and count how often each page is read. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in a site that runs and stays safe. Raw records are deleted after 90 days at most; counts without any IP address are kept longer. A hosting company runs the server and handles this data for us, on our instructions only.

Cloudflare ahead of the site

The pages and the email of this domain run through Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA), which speeds up delivery, filters attacks and forwards email to our mailbox. To do so Cloudflare processes your IP address and technical connection data.

The legal basis is Article 6(1)(f) GDPR: our interest in a quick and protected site. Cloudflare is certified under the EU-US Data Privacy Framework, and the European Commission's standard contractual clauses apply in addition. Cloudflare describes its own handling at cloudflare.com/privacypolicy.

Show photographs

Pictures of the shows and tours are loaded directly from the image servers of GetYourGuide (GetYourGuide Deutschland GmbH, Sonnenburger Straße 73, 10437 Berlin, Germany). To display one, your browser contacts those servers and hands over your IP address. We have no influence on that exchange.

The legal basis is Article 6(1)(f) GDPR: our interest in showing every ticket and tour with the provider's own current photographs.

If you follow a booking link

Each booking link goes straight to GetYourGuide and holds our partner number, which lets the platform credit us with the booking.

After you reach GetYourGuide, that platform sets its own cookies and processes your data under its own privacy policy. We get back commission reports with totals only, with no names, contact details or payment data.

Video clips from YouTube

Videos are embedded in YouTube's privacy-enhanced mode and remain a still picture until you press play, so before that your browser makes no contact with YouTube. After you press play, the video loads from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), which receives your IP address and may set cookies.

Your press of the play button is your consent: Article 6(1)(a) GDPR and Section 25(1) TDDDG. Google's privacy policy: policies.google.com/privacy.

Small notes your browser keeps

Your browser keeps a few small notes so the site can do what you asked. They stay on your device and we have no way to read them:

• the items you ticked on an evening list, so they stay ticked on your next visit (local storage, kept until you clear it);
• the currency chosen in the menu, so prices keep that currency on each page (local storage, kept until you clear it);
• if you open a chat: its reference number, an access key, your email address and a copy of the thread, so it is waiting when you return (local storage, kept until you clear it);
• a note that the chat bubble has already appeared, so it stays quiet afterwards (session storage, erased when the tab closes);
• a note that the window shown as you move to leave has already appeared, so it does not come back (session storage, erased when the tab closes).

These notes are strictly necessary for functions you use yourself (Section 25(2) No. 2 TDDDG). You can erase them at any time in your browser settings.

Chat threads

Opening a chat means giving us your name, your email address and your messages. The chat service also logs the country your connection comes from, a hashed form of your IP address (a salted hash that cannot be turned back into the address), and the page and language you wrote from.

The thread is kept with Cloudflare (named above), and each message you write is passed on to our account with the messaging service Telegram, which processes it outside the European Union; our replies return the same route. More: telegram.org/privacy. We use your address only for the reply.

The legal basis is Article 6(1)(b) GDPR, since you ask and we reply, plus Article 6(1)(f) GDPR for the hashed IP address, which we use only against abuse and spam. A thread is removed automatically 180 days after its last message.

Emailing Palace Legong

When you email us we use your message to reply. The legal basis is Article 6(1)(f) GDPR, or Article 6(1)(b) GDPR if the message concerns a contract. Once the exchange ends we delete it, unless the law obliges us to keep it.

Type and map art

Fonts come from our own server, so no font service learns of your visit. Maps are pictures kept on our own server and drawn from OpenStreetMap data; viewing or zooming them contacts no map service. A "Google Maps" link opens Google only when you press it.

Our source list

Our pages quote official and expert sources and link to them. Nothing goes to those sites until you open a link, and from that moment their own privacy rules apply.

Requests you can make

You may ask what data we hold about you (Article 15 GDPR), have it corrected (Article 16) or deleted (Article 17), have its processing restricted (Article 18) and receive it in a portable format (Article 20). Where we rely on a legitimate interest you may object at any time (Article 21), and any consent can be withdrawn for the future. Send a note to [email protected] and your request gets handled by hand.

You may also complain to a data protection supervisory authority, particularly in the EU country where you live or work or where the suspected infringement happened (Article 77 GDPR).

We take no automated decisions about you and build no profiles. You need not give us any data, yet a page cannot reach your screen without technical connection data.