Privacy Policy
As of October 2026. This is an English translation for convenience. The German version is legally authoritative.
1. Data Controller
Yang Sun
c/o ZERODOX
Gulisastraße 93
56072 Koblenz
Germany
Email: contact@china-panorama.com
2. Hosting
This website is hosted on the Cloudflare Workers platform. The provider is Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (plus Cloudflare Germany GmbH for customers in the EU). When you access the website, Cloudflare collects technically necessary server log data (e.g. IP address, timestamp, requested URL) to deliver and secure the website.
A transfer of personal data (in particular the IP address) to Cloudflare in the USA cannot be ruled out. The legal basis for this is Art. 6(1)(f) GDPR (legitimate interest in a reliable and secure delivery of the website) in conjunction with the EU-U.S. Data Privacy Framework, for which Cloudflare is certified, and alternatively EU Standard Contractual Clauses. A data processing agreement (Data Processing Addendum) under Art. 28 GDPR is in place with Cloudflare. Details: Cloudflare Privacy Policy.
3. Reach measurement (cookie-free)
We do not set cookies and do not create personal usage profiles. To gauge reach we use three sources:
a) Cloudflare statistics. Cloudflare generates aggregated statistics from the log data described in section 2 (e.g. number of page views, country of origin, requested URLs). This evaluation takes place without cookies and without accessing your device; individual persons cannot be identified from it.
b) Our own server-side count. A program on Cloudflare's servers (Cloudflare Workers) counts each page view. Only the following is stored: the page requested, country of origin, the domain of the referring page (if you come from another page of this website, also its path, e.g. /en/beijing/), device category (mobile/desktop), campaign parameters in the address (utm_source, utm_medium, utm_campaign, e.g. when you arrive via a Pinterest pin) and whether the request was automated (crawler). To recognise automated requests more reliably, we also store the type of network the request comes from (data centre, relay service such as iCloud Private Relay, or ordinary internet connection; only this category, not the network operator), the HTTP version used, and whether your browser sends the Sec-Fetch-Mode, Sec-Fetch-User, Sec-Purpose (preloading) and Accept-Language headers (only whether they are present, not e.g. your language setting). IP addresses and full browser identifiers are not stored. The data is kept in Cloudflare Workers Analytics Engine and deleted automatically after three months. Counting takes place entirely server-side, without cookies and without accessing your device.
c) Cloudflare Web Analytics – only for visitors outside the EU. For visits from outside the EU, Cloudflare automatically adds a small JavaScript (Cloudflare Web Analytics) to the page. When a page is viewed, it sends, among other things, the page URL, the referring page, browser and operating system type and loading times to Cloudflare. It sets no cookies, uses no local storage and, according to Cloudflare, does not fingerprint individual users. The script is not added for visitors from the EU; for them nothing is stored on or read from the device, so consent under Section 25 TDDDG is not required.
The legal basis in each case is Art. 6(1)(f) GDPR (legitimate interest in a needs-based design and technical optimisation of the website). For data transfers to the USA, see section 2.
4. Storage in your browser (localStorage)
Some tools on this website remember your choices in your browser's local storage (localStorage): the items you tick on the travel checklist and on the travel kit checklist, and the country you select on the health and medication page. This information does not leave your device and is not sent to us or to anyone else. Storing it is strictly necessary for the function you are using (Section 25(2) no. 2 TDDDG). You can delete it at any time by clearing this website's data in your browser.
5. No third-party content or scripts
No third-party services are embedded on this website: no advertising or tracking pixels, no social media plugins (including Pinterest), and no externally loaded fonts, videos or maps. Fonts, images and maps are served from our own server. Links to other websites are ordinary links; data is only sent to the other provider when you click such a link, and that provider's privacy policy then applies. For affiliate links see section 6.
6. Affiliate links (/go/)
Some links on this website are affiliate links; they are marked “Ad”. They first lead to an address on our own domain (/go/…) and are redirected from there through the affiliate network Travelpayouts (Go Travel Un Limited, Hong Kong) to the provider: Airalo, Saily, Yesim, Trip.com or GetYourGuide. If a booking results from such a link, we receive a commission.
What we store when you click. Our server (Cloudflare Workers, see section 2) counts the click. We store: which affiliate link was clicked, on which page and where on the page, a random number generated anew for every click, country of origin, device category and the signals for detecting automated requests listed in section 3 b. IP addresses and full browser identifiers are not stored. No cookie is set and nothing is stored on or read from your device. The data is deleted automatically after three months.
What Travelpayouts and the provider receive. When redirecting, we add an identifier made of the page, the link position and the random number to the link (for example en_esim_box_k3f9x2). It contains no information about you; we use it to attribute commissions to a page and position. As with any link, your browser also transmits, for technical reasons, your IP address, browser and device details and, with usual browser settings, our website's domain as the referring site. From the click on, Travelpayouts and the provider process your data under their own responsibility. They use cookies or similar techniques to attribute a booking to the affiliate link; some of them are based outside the EU. Their privacy policies apply: Travelpayouts, Airalo, Saily, Yesim, Trip.com, GetYourGuide.
Without a click on an affiliate link, no data is sent to Travelpayouts or the providers; no scripts, pixels or widgets of the partners are embedded (section 5). The legal basis for counting is Art. 6(1)(f) GDPR (legitimate interest in funding the website through commissions and in measuring which recommendations are used).
7. Newsletter
A newsletter is in preparation. The sign-up form is not active yet; no email addresses are currently sent or stored through it. Before the launch we will add the email service provider and the sign-up procedure (double opt-in) to this section.
8. Contact Form and Email
On the legal notice page you can write to us through a form, for example to report a mistake on a page. We store: the type of message you choose, your text, the page you name, the language of the form, the time and – only if you provide it – your email address. We use this information only to handle your message, improve the website and, where applicable, reply to you.
To protect against automated spam, you type a few characters from a picture generated by our server before writing, and your browser also solves a small computing task (proof of work) in the background. Our server checks both itself. No third-party service is involved for this and nothing is stored on your device. To limit repeated sending, your IP address is briefly used as a counter but not stored.
Messages are stored in a database at Cloudflare (Cloudflare D1, EU location) under the data processing agreement mentioned in Section 2 and are deleted automatically after twelve months; messages identified as spam after 30 days. If you email us, we process your email address and the content only to reply.
The legal basis is Art. 6(1)(f) GDPR (legitimate interest in handling feedback and enquiries) or Art. 6(1)(b) GDPR where your enquiry relates to a contract. Providing an email address is voluntary.
9. Your Rights
You have the right to access, rectification, erasure, restriction of processing and data portability. Where we process data on the basis of Art. 6(1)(f) GDPR, you may object to this processing at any time under Art. 21 GDPR. Please contact the address given above.
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg).