Privacy and your data.

1. Introduction

Welcome to Kiri Travel ("we," "our," or "us"). We are committed to protecting your privacy and ensuring you have a positive experience on our website and while using our app. This policy explains our data practices and your rights regarding your personal information.

The controller of your personal data is Icaro Sabino Torres, who publishes the Kiri Travel app. For any question about your data, write to contact@kiritravel.eu.

13. Changes to This Policy

We may update this policy periodically. We will notify you of significant changes by posting a notice on our website or sending you an email. Continued use of our services after changes constitutes acceptance of the updated policy.

14. Data Protection Contact

For all privacy-related inquiries, data protection requests, or to exercise your rights under GDPR, please contact our Data Protection team:

• Email: contact@kiritravel.eu
• Response time: We aim to respond to all requests within 30 days.

If you are not satisfied with our response, you have the right to lodge a complaint with the Portuguese Data Protection Authority (CNPD) at www.cnpd.pt.

15. Contact Us

If you have general questions about this policy or our practices, please contact us at contact@kiritravel.eu.

2. Information We Collect

2.1 Information You Provide

We collect information you provide directly, including:

• Account information (name, email, password)
• Profile information (photos, preferences)
• Travel plans and itineraries
• Content you share (reviews, photos, comments)
• Communication with us (feedback, support inquiries)

2.2 Automatically Collected Information

When you use our services, we automatically collect:

• Device information (device type, operating system)
• Log information (IP address, browser type, pages visited)
• Location information (with your permission)
• Usage information (features used, travel preferences)

3. Legal Basis for Processing (GDPR Art. 6)

We process your personal data based on the following legal grounds:

• Contract (Art. 6(1)(b)): Processing necessary to provide our services — including account creation, trip planning, itinerary management, and customer support.
• Consent (Art. 6(1)(a)): Where you have given explicit consent — including marketing emails, newsletters, optional location sharing, and non-essential cookies (analytics and preference cookies).
• Legitimate Interest (Art. 6(1)(f)): Processing necessary for our legitimate interests — including service improvement, fraud prevention, security, and recording technical errors so we can fix them.
• Legal Obligation (Art. 6(1)(c)): Processing required to comply with applicable laws — including tax obligations, legal requests from authorities, and data breach notifications.

You may withdraw your consent at any time where consent is the legal basis for processing. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

4. How We Use Your Information

We use your information to:

• Provide and improve our services
• Personalize your experience
• Process transactions
• Send notifications about your trips
• Communicate with you about our services
• Ensure security and prevent fraud

12. Children's Privacy

Kiri Travel is intended for users aged 13 and above. We do not knowingly collect data from children under 13. If we discover that we have collected data from a child under 13, we will delete it promptly.

5. Sharing Your Information

We may share your information with:

• Travel partners (only as necessary to fulfill your requests)
• Service providers (who help us deliver our services)
• Legal authorities (when required by law)

We never sell your personal information to third parties.

6. Service Providers

We use the following service providers to run the website and the app. Most process data on our behalf; some, such as Google, also act under their own privacy policies, linked below:

Ads in the app: the app shows ads served by Google AdMob. To show and measure them, Google may use your device's advertising identifier, your IP address and your interactions with the ads, under its own policy. You can reset or limit the use of the advertising identifier in your device settings. The website shows no ads of its own.

Videos: videos on the website play from YouTube in privacy-enhanced mode (youtube-nocookie.com). The video on the home page loads only when you choose to play it; a video embedded in another page loads with that page. When a video loads, Google receives your IP address and technical data about your browser, under its own privacy policy.

This list is updated when we add or change service providers.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including encryption in transit (TLS/SSL), secure authentication, and access controls. However, no internet transmission is completely secure, so we cannot guarantee absolute security.

9. International Transfers

Our main data processing takes place in the European Union. Some providers listed in Section 6 may process data outside the EU/EEA. In such cases, the transfer relies on the safeguards provided for in GDPR Chapter V, such as an adequacy decision or the Standard Contractual Clauses approved by the European Commission, as offered by each provider.

10. Data Retention

We retain your personal data only as long as necessary for the purposes described in this policy. When you delete your account, we delete your personal data or make it anonymous, except where the law requires us to keep it. Data that has been made anonymous can no longer be linked to you and may be kept.

7. Your Choices and Rights

Under the GDPR and applicable data protection laws, you have the right to:

• Access — Request a copy of the personal data we hold about you.
• Rectification — Correct any inaccurate or incomplete personal information.
• Erasure — Request deletion of your account and personal data.
• Restriction — Request restriction of processing in certain circumstances.
• Object — Object to processing based on legitimate interests.
• Data Portability (Art. 20) — Request your personal data in a structured, commonly used, machine-readable format (JSON). To exercise this right, contact us at contact@kiritravel.eu and we will provide your data export within 30 days.
• Withdraw Consent — Where processing is based on consent, you may withdraw it at any time.
• Lodge a Complaint — You have the right to lodge a complaint with your local data protection authority (in Portugal: CNPD — Comissão Nacional de Proteção de Dados).

To exercise any of these rights, contact us at contact@kiritravel.eu. We will respond within 30 days.

11. Cookies & Tracking

We use cookies and similar tracking technologies to enhance your experience. Below are the specific tools and cookie types we use:

• Essential cookies: Required for basic functionality such as session management and security. These cannot be disabled.
• Statistics (off until you turn them on): with your consent, Google Analytics 4 (GA4) measures how the website is used, such as the pages visited and the length of visits, using cookies; we also record the page visited, the referring page, the browser and operating system, and the approximate country, which ipapi.co works out from your IP address. You can turn statistics on or off at any time on the privacy choices page.
• Experience analytics (off until you turn them on): with your consent, Hotjar creates heatmaps and recordings of visits that show how the website is used, so we can improve it. You can turn it on or off at any time on the privacy choices page.
• Preference cookies: Remember your settings and choices (such as language or region) to provide a more personalized experience.

The website shows no ads of its own and sets no advertising cookies. A YouTube video, once you play it, follows Google's policy (see Section 6). The app shows ads, as described in Section 6. You can also manage or delete cookies in your browser settings; disabling essential cookies may affect how the website works.