Privacy Policy

1. Introduction and Controller Information

This Privacy Policy explains how Hastings Dynamics Ltd (trading as "Rivileo") collects, uses, stores, and protects your personal information when you use our platform and services.

Data Controller: Hastings Dynamics Ltd, a company registered in England and Wales under company number 13958053, with registered office at 124 City Road, London, England, EC1V 2NX.

Contact: For privacy-related inquiries, please email hello@support.rivileo.com.

This policy complies with the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR), the Data Protection Act 2018, and other applicable data protection laws worldwide.

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, username, password, profile picture, and preferences
• Profile Data: Travel preferences, bucket lists, saved destinations, and social connections
• User-Generated Content: Posts, comments, reviews, photos, itineraries, and trip plans you create
• Communication Data: Messages, support inquiries, and feedback you send us
• Payment Information: We do not directly collect or store payment card details. Payments are processed by third-party payment processors who handle this data securely

2.2 Automatically Collected Information

• Device Information: IP address, browser type, operating system, device identifiers
• Usage Data: Pages viewed, features used, search queries, click patterns, time spent on pages
• Location Data: Approximate location based on IP address; precise location only with your explicit consent
• Cookies and Tracking: See our Cookie Policy for detailed information

2.3 Third-Party Data Sources

We enrich our platform with publicly available data from:

• OpenStreetMap: Geographic and mapping data (licensed under ODbL)
• Wikipedia and Wikivoyage: Destination information and travel guides (licensed under CC BY-SA)
• Google Maps API: Enhanced mapping, place details, and geocoding services
• User Contributions: Community-submitted content, reviews, and recommendations

We do not purchase personal data from data brokers or third-party marketing lists.

3. Legal Basis for Processing (GDPR)

We process your personal data under the following legal bases:

• Contractual Necessity: To provide our services, manage your account, and facilitate bookings
• Legitimate Interests: To improve our platform, prevent fraud, ensure security, and provide customer support
• Consent: For marketing communications, optional features, and cookies (where required)
• Legal Obligations: To comply with tax, accounting, and regulatory requirements

4. How We Use Your Information

• Service Delivery: Create and manage your account, enable social features, process bookings, and provide customer support
• Platform Improvement: Analyze usage patterns, develop new features, personalize content recommendations
• Communication: Send service updates, respond to inquiries, provide trip recommendations (with consent for marketing)
• Safety and Security: Detect and prevent fraud, abuse, and security incidents; enforce our Terms of Service
• Legal Compliance: Fulfill tax obligations, respond to legal requests, protect our rights
• Commission Processing: Calculate and process commission payments to partners for bookings facilitated through our platform

5. Data Sharing and Disclosure

5.1 We Do NOT Sell Your Data

Important: We do not sell, rent, or trade your personal information to third parties for their marketing purposes. Your data is not a product.

5.2 Service Providers

We share data with trusted service providers who assist us in operating our platform:

• Cloud Hosting: Microsoft Azure (data storage and infrastructure)
• Payment Processing: Stripe and other payment processors (for secure payment handling)
• Analytics: Google Analytics (anonymized usage statistics)
• Error Tracking: Sentry (error reporting and performance monitoring)
• Email Services: Transactional and marketing email providers

All service providers are contractually bound to protect your data and use it only for specified purposes.

5.3 Business Partners

When you book through our platform, we share necessary information with accommodation providers and travel partners to fulfill your booking. We operate on a commission basis for these transactions.

5.4 Legal Requirements

We may disclose your information when required by law, court order, or to protect our rights, safety, or property.

5.5 Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity.

6. International Data Transfers

We are based in the UK. Your data may be transferred to and processed in countries outside the UK and EEA, including the United States and other jurisdictions where our service providers operate.

For transfers outside the UK/EEA, we ensure adequate protection through:

• Standard Contractual Clauses (SCCs) approved by the UK ICO and EU Commission
• Adequacy decisions recognizing equivalent data protection standards
• Binding Corporate Rules and other approved transfer mechanisms

7. Data Retention

We retain your personal data only as long as necessary for the purposes outlined in this policy:

• Active Accounts: Data retained while your account is active
• Deleted Accounts: Most data deleted within 30 days; some data retained for legal/accounting purposes (up to 7 years)
• Marketing Data: Retained until you unsubscribe or withdraw consent
• Legal Obligations: Data retained as required by tax, accounting, and regulatory laws

8. Your Rights (GDPR/UK GDPR)

You have the following rights regarding your personal data:

• Right of Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your data (subject to legal obligations)
• Right to Restriction: Limit how we process your data
• Right to Data Portability: Receive your data in a machine-readable format
• Right to Object: Object to processing based on legitimate interests or for direct marketing
• Right to Withdraw Consent: Withdraw consent at any time (where processing is based on consent)
• Right to Lodge a Complaint: Contact the Information Commissioner's Office (ICO) in the UK or your local data protection authority

To exercise these rights, email hello@support.rivileo.com. We will respond within one month.

9. Children's Privacy

Our services are not intended for children under 13 years of age (or 16 in the EEA). We do not knowingly collect personal information from children.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at hello@support.rivileo.com, and we will delete such information within 30 days.

For users aged 13-18 (or 16-18 in the EEA), we recommend parental guidance when using our platform.

10. Security Measures

We implement industry-standard security measures to protect your data:

• Encryption in transit (TLS/SSL) and at rest
• Regular security audits and vulnerability assessments
• Access controls and authentication mechanisms
• Employee training on data protection
• Incident response and breach notification procedures

However, no system is completely secure. We cannot guarantee absolute security of your data.

11. Cookies and Tracking Technologies

We use cookies and similar technologies. For detailed information, please see our Cookie Policy.

12. Third-Party Links

Our platform may contain links to third-party websites. We are not responsible for their privacy practices. Please review their privacy policies before providing any information.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or prominent notice on our platform. Continued use after changes constitutes acceptance.

14. Contact and Complaints

For privacy questions, concerns, or to exercise your rights:

Email: hello@support.rivileo.com

Post: Hastings Dynamics Ltd, 124 City Road, London, England, EC1V 2NX

Supervisory Authority: If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) in the UK at ico.org.uk or your local data protection authority.