Privacy

Controller

Rodolfo Filgueiras Franco, operating as RodWalks, is responsible for processing personal data on this website. You can contact him at the address and email below.

Website delivery and security

Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, delivers the website through its hosting and content delivery network and protects it against abuse. Web requests include your IP address, requested URL, request time, browser information and security signals.

Processing supports reliable delivery and security under Article 6(1)(f) GDPR. Cloudflare processes data under its data processing agreement. International transfers use applicable safeguards, including standard contractual clauses. Security and request records follow Cloudflare’s applicable retention settings.

Cookies and your choice

Necessary storage keeps your cookie choice in this browser for 180 days. Optional purposes start with consent denied. Use Cookie settings in the footer to review or withdraw your choice at any time. Withdrawal applies to future processing; earlier consent remains valid for the period before withdrawal.

When an optional purpose is enabled, Cloudflare Zaraz applies your selection to the relevant tools. Consent-based processing uses Article 6(1)(a) GDPR and § 25(1) TDDDG for optional device storage or access. Necessary storage uses § 25(2) TDDDG.

Contact by email or WhatsApp

The contact form prepares a draft on your device. Choosing email or WhatsApp opens the selected app so you can review and send your message. We process the name, contact details, plans and message you send to answer your enquiry or arrange a tour under Article 6(1)(b) GDPR; other correspondence uses Article 6(1)(f).

Correspondence is kept for the enquiry and any resulting arrangements. Records subject to statutory retention duties are retained for the applicable period under Article 6(1)(c). Email delivery providers process message and delivery data. WhatsApp processes data under its own privacy terms when you use it.

External links and review sources

Public booking on RodWalks is handled directly by RodWalks. Links to Instagram, WhatsApp or Google Reviews open those services, which apply their own privacy terms.

Review excerpts shown on RodWalks were originally published on GuruWalk and Airbnb. RodWalks does not independently verify reviewer identity beyond publication on the source platform. Source and rating information was last checked on 1 October 2026.

Your rights

You may request access, correction, deletion, restriction or portability of your personal data where applicable. You may object to processing based on legitimate interests and withdraw consent at any time. Contact hello@rodwalks.com to exercise your rights. You may also complain to a supervisory authority, including the Berlin data protection authority.

Private walk requests

We use your preferred date and time, language, guest count, first name, email and optional message to respond to your private walk request under Article 6(1)(b) GDPR. A request receives a reference and an acknowledgement email. Contact details and the message are anonymized 90 days after both the preferred date and the last operational update. Request events follow the twelve-month operational retention period.

Direct reservations

We collect your name, email, chosen date and language, and guest count to reserve your places, send operational messages and manage cancellations. The basis is contract or pre-contract processing under Article 6(1)(b) GDPR. Cloudflare Workers and EU-jurisdiction D1 process these records under the hosting data-processing agreement. Transactional emails are handled by Cloudflare Email Service when activated; messages contain reservation or sign-in information.

Reservation contact details are kept for 90 days after the walk, then anonymized. Necessary records subject to a documented legal obligation or dispute are retained for the applicable period. Encrypted email delivery records are deleted after 30 days, except for messages linked to a documented hold. Holds record a reason, review date and release decision. Reservation events without contact details are retained for 12 months for operational accountability.

Review requests

If you actively select the optional review-request checkbox when booking, RodWalks records that consent and may send one review-request email after the walk only when attendance is recorded. This uses Article 6(1)(a) GDPR. The email includes a link to stop future review requests; you can also withdraw by contacting hello@rodwalks.com. A keyed email hash is retained as the minimal suppression record needed to respect an opt-out. Leaving the box unchecked does not affect the booking.

Optional accounts and security

An optional account uses a verified email identity through Google, Apple or a one-use email sign-in link. Google or Apple supplies the identity fields needed to sign in, including name and verified email. An Apple relay email is treated as its own identity. Bookings are associated only with a verified matching email, or after ownership verification of the original booking email.

The necessary session cookie is HttpOnly, uses SameSite=Lax, and expires after seven days. Session and sign-in tokens are hashed server-side. Email sign-in links expire after five minutes and work once. Necessary authentication storage is separate from optional analytics and uses §25(2) TDDDG. Delete your account in My bookings using a one-use email confirmation valid for five minutes in the requesting browser. Deletion revokes every account session; reservations remain valid and necessary reservation records follow their own retention period.

Turnstile and short-lived rate limits protect booking and sign-in against automated abuse under Article 6(1)(f) GDPR. Rate-limit records use temporary keyed hashes rather than guest IP addresses in reservation records. Google review links open the owner’s public Business Profile; Google applies its own privacy terms. Optional post-tour review requests apply only to guests recorded as attended.