Privacy Policy

Last updated: 15 November 2026

This policy explains what happens to your personal data when you visit this site or place an order with Munich Authority.

1. Who is responsible for your data

Munich Authority runs this site and decides how your data is used, which makes us the “controller” under data protection law. You can reach us at support@munich-authority.de or through the contact form.

We are a concierge service and are independent of the attractions. Each attraction answers for the data it handles itself, for example when it issues your ticket.

2. The data we collect

Booking details. Your first and last name, your email address and phone number, the attraction, the date of your visit, and the number and type of your tickets. The ticket type shows whether a visitor is an adult, a child, a student or a senior.
Checkout details. Your billing address and any note you add to the order.
Payment details. Stripe, our payment provider, processes your payment and receives your card details or the details of another payment method you choose. We learn whether the payment went through. Your full card number never reaches us.
Messages. When you write to us through the contact form or by email, we receive your name, your contact details, your order number if you give it, and your message. The site stores contact form messages and sends us a copy by email.
Technical data. When your browser opens a page, our hosting provider records data such as your IP address, the time, the page and your browser type. The shop also notes how you reached the site, for example the website or advertisement you came from, and saves that with your order.
Your cookie choice. We record the answer you give in the cookie notice (section 5).

You can order without creating an account.

3. Why we use your data

We use your data for the purposes below. Where the law asks for a legal basis, it is named in brackets.

To carry out your order. We purchase the tickets from the official provider in your name, deliver them to you by email, answer your questions and handle refunds (performance of our contract with you).
To keep the business and tax records that the law demands of us (legal obligation).
To keep the site secure, to prevent fraud and to measure whether our advertising leads to orders (our legitimate interests).
To let Google show you advertising that fits your interests. This happens only after you click “Accept” in the cookie notice (your consent).

We need your name, your email address and your order details to carry out an order, and we cannot process an order without them.

4. Who receives your data

We pass your data on only as far as our service requires.

The attraction and its official ticket provider receive the details needed to issue tickets in your name. That usually means your name, the date of your visit and the ticket types.
Stripe processes payments.
Rocket.net hosts this site and delivers it through the Cloudflare network.
Our email provider carries our email.
Google provides advertising measurement and fonts (section 5).
Adobe provides fonts, and the OpenStreetMap Foundation provides the map (section 5).

We may also disclose data when a law or a court order requires it, or when we need the data to assert or defend a legal claim.

5. Cookies, Google Ads and services from other providers

Cookies of the shop. The shop and the booking form set cookies that remember your basket, the steps of your booking, your time zone and the language of the page you last opened. At checkout, Stripe sets cookies that help it detect fraud. The shop also sets cookies that remember how you reached the site. The site sets these cookies for every visitor.

Google Ads. We advertise with Google Ads, a service of Google Ireland Limited and Google LLC. A Google tag on this site sets cookies and sends Google data about your visit: your IP address, the pages you open and, after an order, the order number and its value. This shows us whether an advertisement led to an order. We treat this measurement as necessary for running our service, so the tag runs for every visitor, whichever button you press in the cookie notice.

The cookie notice gives you a choice about personalised advertising. If you click “Accept”, we tell Google that you consent, and Google may use data about your visit to show you advertising that fits your interests. With “Accept only necessary”, personalised advertising stays switched off and we report no consent to Google. You can change your answer at any time: the link “Cookies” at the foot of every page opens the notice again.

We keep a record of every answer given in the cookie notice. It holds the time, the answer and a random number that your browser creates. The record itself contains neither your name nor your IP address.

Fonts. The site loads its typefaces from Adobe Fonts (Adobe Inc.) and from Google Fonts. Your browser fetches them from Adobe’s and Google’s servers, which see your IP address when it does.

Map. The map of the attractions loads its map images from the OpenStreetMap Foundation in the United Kingdom, which also sees your IP address.

6. Emails

We write to you about your order: the order confirmation, your tickets and replies to your questions. We send no newsletters and no advertising by email.

7. How long we keep your data

We keep order records for as long as we need them to carry out the order and to answer later questions about it, and for as long as tax and accounting law requires us to keep business records. Contact messages stay with us while we deal with your question. The site does not delete data on a fixed schedule. You can ask us at any time to delete your data, and we will do so unless a law requires us to keep it.

Your answer to the cookie notice stays in your browser until you change it or clear your browser’s storage. Google’s advertising cookie expires after about 90 days.

8. Where your data is processed

Your data is processed in the United States and in other countries where our providers work. The data protection law of those countries can differ from the law where you live. Where the law demands a safeguard for sending personal data abroad, we rely on one that the law recognises. Examples are the EU-U.S. Data Privacy Framework, under which certified U.S. companies commit to European data protection standards, and the standard contractual clauses published by the European Commission.

9. Your rights

Depending on where you live, data protection law gives you some or all of these rights:

to learn which data we hold about you and to receive a copy
to have wrong data corrected
to have your data deleted
to restrict our use of your data or to object to it, including our use for advertising measurement
to receive the data you gave us in a common electronic format
to withdraw a consent you gave. For the cookie notice, use the link “Cookies” at the foot of the page.

To use a right, write to support@munich-authority.de or use the contact form. We answer within the time the law of your country sets, which for most customers is one month. You may also complain to the data protection authority of the country where you live.

Do Not Track. Some browsers can send a “Do Not Track” signal. This site does not respond to that signal.

Children. Only adults may order on this site. We ask for no names or other details of children. An order shows only how many child tickets it contains.

10. Changes to this policy

We revise this policy when the site or the law changes. The date at the top shows the latest version.