--- title: Privacy Policy description: How iCliGo collects, uses and protects your personal data, and how to exercise your rights under the GDPR. url: https://website-v2.dev.icligo.com/en/privacy language: en updated: 2026-11-10T13:09:58.175Z --- # Privacy Policy ## Privacy Policy **Last updated:** 9 November 2026 ### 1. Who we are **I Cli Go World Wide, Lda** (company number 518151735), with registered office at Rua das Cartas, n.º 468, 4405-542 Vila Nova de Gaia, Portugal ("iCliGo" or "we"), is the controller of the personal data collected through the icligo.com website and the services described in this policy. Bookings and Travel Partner subscriptions are sold and invoiced by the iCliGo group company that corresponds to the country where you live (see section 1 of the [Terms of Use](/en/terms)): My Favourite Experience - Eventos Turísticos, Lda (Portugal), iCliGo US LLC (United States) or I Cli Go World Wide España SL (all other countries). That company is also the controller of the data needed for that contract and its invoicing. You can exercise your rights with any of them through the contacts below. For any question about your personal data, or to exercise your rights, contact us: - by e-mail: **privacy@icligo.com** - by post: I Cli Go World Wide, Lda, "Data Protection", Rua das Cartas, n.º 468, 4405-542 Vila Nova de Gaia, Portugal ### 2. Who this policy applies to This policy applies to anyone who: - visits our website; - asks an iCliGo Travel Partner to contact them or for a quote; - signs up to learn about the iCliGo business (join form and intro webinar); - subscribes to our newsletter; - books travel with us through a Travel Partner; - is an iCliGo Travel Partner (subscription, payments and public profile on our website); - applies for a job at iCliGo. ### 3. What data we process, why and on what legal basis #### 3.1 Browsing the website and security **Data:** IP address, browser and device type, pages requested, date and time. **Why:** to show the website, protect it against abuse and bots (limits on the number of requests and the Cloudflare Turnstile anti-bot check on forms) and fix technical problems. **Legal basis:** iCliGo's legitimate interest in keeping the website secure and working (Article 6(1)(f) GDPR). **Retention:** up to 30 days. #### 3.2 Cookies and usage statistics We use cookies that are strictly necessary for the website to work. Analytics cookies (Google Analytics, Microsoft Clarity) and marketing cookies are only used with your consent, which you can change or withdraw at any time under **Cookie settings** in the footer. **Legal basis:** consent (Article 6(1)(a) GDPR and Portuguese Law 41/2004 of 18 August). We never send your name, e-mail address or phone number to analytics tools, and we remove personal codes from page addresses (for example, the sign-up pre-fill code) before measuring them. The full list of cookies is in the [Cookie Policy](/en/cookies). **Shares.** When someone uses the Share button or opens a page from a shared link, we count it anonymously: the channel (for example, WhatsApp), the page, the Travel Partner the link is associated with, the language and the day. We store no IP address, cookie or visitor identifier, so these figures are not personal data and do not depend on your consent. They show which content and channels work, and are shown, in aggregate, to Travel Partners in MyOffice. #### 3.3 The Travel Partner who shared the link with you When you arrive through a Travel Partner's link, we associate your visit with that Travel Partner, so that your request is assigned to them. - With your consent to marketing cookies, we keep this association in a cookie (igotravel_referral) for 30 days. - Without that consent, the Travel Partner's name only stays in the page address during your visit. **Legal basis:** consent (cookie) and legitimate interest in assigning your request to the right Travel Partner (page address). #### 3.4 Contact and quote requests to a Travel Partner **Data:** name, e-mail, phone, preferred contact method and message. For a quote request, also the trip details: destination, dates, number of adults and children, the children's ages, board, budget and notes. **Why:** to send your request to the Travel Partner you chose so that they can contact you, and to send you a copy by e-mail. **Legal basis:** steps taken at your request before entering into a contract (Article 6(1)(b) GDPR). **Retention:** 12 months, after which it is deleted automatically. #### 3.5 Joining the Travel Partner network and the intro webinar **Data:** first name, last name, e-mail, phone, country, language, the Travel Partner who invited you, the session you chose and your time zone; after the webinar, whether you attended, which parts you watched and for how long, and the type of device (phone or computer). **Why:** - to register you for the webinar, which is shown on our website, and send you the confirmation, the reminders and an e-mail after the session; - to know whether you attended and for how long: while the video plays, the webinar page tells us every few seconds which parts you watched (to the second) and whether you are on a phone or a computer. We recognise you from the personal link we e-mail you or from the sign-up made in that browser tab; viewers we can't recognise are counted without being identified; - to share your details with the Travel Partner who invited you, so that they can guide you; - to tell that Travel Partner whether you attended the webinar and for how long, so that they contact you at the right time; - to pre-fill the iCliGo sign-up form with the details you already gave us; - if you ticked the optional box, to send you news, offers and initiatives from iCliGo (section 3.6). **Legal basis:** steps taken at your request before entering into a contract (Article 6(1)(b) GDPR). Telling the Travel Partner about your attendance is based on the legitimate interest of iCliGo and the Travel Partner in following up with people interested in the business (Article 6(1)(f) GDPR); you can object at any time. **Retention:** 12 months after you sign up, after which it is deleted automatically. The sign-up pre-fill link stops working after 30 days. #### 3.6 Newsletter and marketing communications **Data:** e-mail and language; the date you confirmed and where you asked (the newsletter form or the box in the join form). **Why:** to send you the newsletter and iCliGo communications. Whether you ask in the newsletter form or with the box in the join form, you are only added to the list after you confirm through the link we e-mail you. **Legal basis:** consent (Article 6(1)(a) GDPR), which you can withdraw at any time through the link in every e-mail or by contacting us. **Retention:** until you withdraw your consent. #### 3.7 Customers who book travel **Data:** what the booking needs: name, date of birth, nationality, identity card or passport (when required by the supplier or the destination), contact details, billing and payment details, and any preferences or special needs you tell us. **Why:** to book and provide the travel services, invoice them and support you during your trip. **Legal basis:** performance of the contract (Article 6(1)(b) GDPR) and compliance with legal obligations, such as tax and package travel rules (Article 6(1)(c) GDPR). Health data (for example, reduced mobility or allergies) is only processed if you give it to us, with your explicit consent (Article 9(2)(a) GDPR). **Retention:** for the duration of the contract and then for the periods required by law (invoices and accounting records: 10 years). #### 3.8 Travel Partners' public profiles **Data:** name, photo, cover image, biography, location, languages, social networks and contact details the Travel Partner entered in their private area. **Why:** to present the Travel Partner in the website directory. The phone number and e-mail address only appear when the visitor clicks to see them. Profiles without their own biography or cover are not indexed by search engines. **Legal basis:** performance of the contract with the Travel Partner (Article 6(1)(b) GDPR). **Retention:** while the contract is in force. #### 3.9 Travel Partner subscriptions and payments **Data:** name, e-mail, phone, billing address, tax number, the subscription chosen, payment history and the details needed to process each payment. **Why:** to manage the Travel Partner's subscription, take payments (including recurring payments) through our payment platform and the payment provider chosen (section 5), issue invoices and deal with refunds or failed payments. **Legal basis:** performance of the contract with the Travel Partner (Article 6(1)(b) GDPR) and compliance with legal obligations, such as invoicing and tax rules (Article 6(1)(c) GDPR). **Retention:** while the subscription lasts and then for the periods required by law (invoices and accounting records: 10 years). #### 3.10 Job applications **Data:** what is in your CV and application. **Legal basis:** steps taken at your request before entering into a contract (Article 6(1)(b) GDPR) and, to keep your application for future opportunities, your consent. **Retention:** for the recruitment process; with your consent, up to 12 months. #### 3.11 Legal obligations and legal claims We may process and keep data to comply with legal obligations and to establish, exercise or defend legal claims (Article 6(1)(c) and (f) GDPR). ### 4. The role of Travel Partners iCliGo Travel Partners are independent entrepreneurs, not iCliGo employees. When we send them your details (contact request, quote request or sign-up to learn about the business), the Travel Partner processes them as an **independent controller**, only to contact you and follow up on what you asked for. Under their contract with iCliGo, each Travel Partner must: - use your data only for that purpose, and never sell it or pass it on to third parties; - not send you marketing communications without your consent; - keep the data secure and confidential, and delete it when it is no longer needed; - respect your rights, and forward to iCliGo any request about your data that they cannot handle. When a Travel Partner makes a booking for you, they act in the name and on behalf of the iCliGo company that sells it (section 1), which is the controller of that booking's data (section 3.7). You can exercise your rights with the Travel Partner or with iCliGo. Requests made to iCliGo that concern the Travel Partner are forwarded to them. ### 5. Who we share your data with We do not sell personal data. We only share it with: - **Travel Partners**, as described in section 4; - **iCliGo group companies**, to sell, invoice and support your booking or subscription (section 1); - **travel providers**, for bookings (section 3.7), who process the data as independent controllers; - **payment providers** (Stripe, Checkout.com, ifthenpay, PayPal, Klarna, Apple Pay and Google Pay), through our own payment platform, to process payments for bookings and Travel Partner subscriptions. Depending on the provider, they process the data on our behalf or as independent controllers, under their own privacy policies; - **public authorities**, when the law requires it; - **providers who process data on our behalf** (processors), listed below. Processors only process the data on our instructions, under a contract in line with Article 28 GDPR: - Mailjet (Sinch Mailjet SAS, France): sending e-mails and the newsletter; - Cloudflare, Inc. (United States): anti-bot check on forms; - Bunny.net (BunnyWay d.o.o., Slovenia): content delivery network (CDN) and streaming of the webinar videos; - Consent Studio (Vallonic B.V., the Netherlands): cookie consent management; - Google (Google Ireland Limited and Google LLC): Google Analytics and Google Tag Manager, only with your consent; Google Places, to search and complete your address in the Travel Partner sign-up (the address you type); - Microsoft (Clarity): website usage analytics, only with your consent; - cloud hosting and storage providers for the website and its images. YouTube videos on the website use privacy-enhanced mode and only load when you click to watch them. ### 6. Transfers outside the European Economic Area Some providers (Cloudflare, Google, Microsoft and some payment providers, such as Stripe, PayPal and Apple) are in the United States or may access the data from there. We only make these transfers with the safeguards provided for in the GDPR: the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework, when the recipient is certified, or the standard contractual clauses approved by the European Commission (Article 46 GDPR), with additional measures where needed. You can ask us for a copy of these safeguards. If you live in the United States, your bookings and subscriptions are handled by iCliGo US LLC, in the United States. ### 7. How long we keep data - Contact and quote requests, sign-ups and webinar bookings: 12 months, deleted automatically, also at our e-mail provider (Mailjet), unless you are subscribed to the newsletter. - Sign-up pre-fill link: 30 days. - Newsletter and marketing communications: until you withdraw your consent. - Cookie of the Travel Partner who shared the link: 30 days. Other cookies: see the [Cookie Policy](/en/cookies). - Bookings, Travel Partner subscriptions and invoicing: the periods required by law (10 years for accounting records). - Technical and security logs: up to 30 days. - Travel Partner profiles: while the contract lasts. When these periods end, the data is deleted or anonymised. ### 8. Your rights You have the right to: - **access**: know whether we process your data and get a copy; - **rectification**: correct inaccurate or incomplete data; - **erasure**: ask us to delete your data; - **restriction**: ask us to suspend processing, for example while we check a correction; - **portability**: receive the data you gave us in a structured, machine-readable format; - **object**: object to processing based on legitimate interest (for example, telling the Travel Partner about your webinar attendance) and, without giving reasons, to direct marketing; - **withdraw your consent** at any time, without affecting the processing carried out before. To exercise these rights, write to **privacy@icligo.com**. We reply within one month, which may be extended by two further months for complex requests (we will let you know if so). We may ask you to confirm your identity. When we delete your data, we also delete it at Mailjet. You also have the right to lodge a complaint with the Portuguese data protection authority ([CNPD](https://www.cnpd.pt)) or with the supervisory authority of the country where you live or work. ### 9. Automated decisions We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you. ### 10. Children Our services, including joining the Travel Partner network and asking for a quote or a booking, are for people aged 18 or over. We do not knowingly collect data from anyone under 18, except for children who travel, whose details are given by their parents or legal guardians for a quote request or a booking (for example, their age). ### 11. Security We protect your data with technical and organisational measures appropriate to the risk (Article 32 GDPR), including encrypted connections (HTTPS), access limited to those who need the data, protection against bots and abuse, signed personal links that expire, and automatic deletion of data that is no longer needed. If a personal data breach poses a risk, we notify the CNPD within 72 hours and, where the law requires, the people affected. ### 12. Links to other websites The website links to third-party websites (for example, social networks and partners), which have their own privacy policies. We recommend that you read them. ### 13. Changes to this policy We may update this policy. The current version is always on this page, with the date of the last update. If the changes are significant, we will also let you know through our usual channels. See also the [Terms of Use](/en/terms) and the [Cookie Policy](/en/cookies).