Privacy Policy
1. Data Controller
We have not appointed a Data Protection Officer, as it is not mandatory given the size and nature of our activity. All privacy-related requests can be sent to the email address above.
2. What Charitrip does (context for this Policy)
Charitrip is a marketplace that connects travellers with independent third-party providers ("Providers"), including NGOs, charities and social-impact hosts, who offer tourism experiences and accommodation packages. Access to the Platform is provided through a paid subscription, processed via our payment provider, Stripe. Charitrip does not process payment for the trips or accommodation booked with Providers; that payment is made directly between the Traveller and the Provider.
This context matters for this Policy because some of your personal data may need to be shared with Providers so that a booking or enquiry can be fulfilled. See Section 8.
3. Legal basis for processing (Article 6 GDPR)
4. Personal data we collect
Account credentials, Subscription plan and billing status. Card details are processed and stored by Stripe; we never store full card numbers.
Pages visited, time on page, click behaviour, session recordings and heatmap interactions, traffic source and campaign attribution (UTM)
Messages sent through contact or enquiry forms, email correspondence, interactions on our social media channels
5. Tracking technologies and analytics tools we use
Purpose
These tools may collect data such as pages visited, click behaviour, device information and campaign source. Non-essential tracking (Meta Pixel, VWO, Microsoft Clarity and Google Analytics where applicable) is only activated after you provide consent through our cookie banner. You can withdraw consent at any time: see our Cookie Policy for details on how to manage your preferences.
6. Email communications
Account confirmation, billing receipts, service updates, password resets. These are part of operating your account and Subscription, and are not optional while you hold an active account.
Newsletters, new Provider announcements and promotions, sent only if you have given explicit consent. You may unsubscribe at any time using the link in each marketing email or by contacting us directly.
7. How we use your data
- Create and manage your account and Subscription
- Process payments (via Stripe) and manage billing
- Facilitate connections and enquiries between Travellers and Providers
- Respond to enquiries and provide customer support
- Send transactional and, where consented, marketing communications
- Analyse and improve the Platform's performance and user experience
- Detect, prevent and address fraud, abuse or security issues
- Comply with legal and tax obligations
8. Sharing of data
Providers, when you make an enquiry or booking, to the extent necessary for them to respond or fulfil the experience or accommodation package
- Payment processors (Stripe), to process your Subscription payment
- Hosting providers, to operate the website and store data securely
- Analytics and marketing tool providers listed in Section 5
- Legal or governmental authorities, when required by law or to protect our rights
All third-party processors that handle personal data on our behalf operate under GDPR-compliant Data Processing Agreements (DPAs).
9. International data transfers
Some of our service providers (analytics, email marketing or hosting tools) may process data outside the European Economic Area (EEA). Where this occurs, we ensure appropriate safeguards are in place, such as:
- Standard Contractual Clauses (SCCs)
- Adequacy decisions issued by the European Commission
- Other legally recognised transfer mechanisms
10. Data retention
- For as long as your account remains active
- For as long as necessary to fulfil contractual or legal obligations (invoicing, tax records)
- Until you request deletion of your data
11. Your rights under GDPR
If you are located in the European Economic Area, or in any jurisdiction granting equivalent rights, you have the right to:
To exercise any of these rights, contact us at hello@charitrip.world.
12. Global users
Charitrip is available to users worldwide. Regardless of your location, we apply the data protection standards described in this Policy to all users of the Platform. If you access the Service from outside the EEA, your data will be transferred to and processed in Spain and, where applicable, by the third-party providers listed in Section 5, under the safeguards described in Section 9.
13. Security measures
- SSL/TLS encryption
- Firewall protection
- Role-based access controls
- Secure hosting infrastructure
- Password protection
- Limited internal access to personal data on a need-to-know basis
14. Children's privacy
The Service is not directed at children, and we do not knowingly collect personal data from individuals without the legal capacity to enter into a contract in their jurisdiction. If you believe a child has provided us with personal data, please contact us so we can take appropriate action.
15. Changes to this Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify users of significant changes via email or a notice on the Platform. Continued use of the Service after changes take effect constitutes acceptance of the updated Policy.