Privacy Policy

This policy explains how we collect and use your personal data when you visit magandaexperience.com, contact us, join a waitlist, subscribe to our emails or book one of our trips. We keep it in plain language on purpose; if anything is unclear, write to us and we will explain it.

1. Who is responsible for your data

• Controller: Maganda Experience OÜ
• VAT number: EE102740310
• Address: Tööstuse 75-71, 10416 Tallinn, Estonia
• Email: hello@magandaexperience.com
• Data protection contact: hello@magandaexperience.com

2. What data we collect

2.1 Data you give us

• Contact, waitlist and lead forms: first name, surname, email address, WhatsApp or phone number, the trip you are interested in, and anything you write in the message field.
• Newsletter sign-up: email address and, when provided, first name.
• Working with us: the professional details and any documents you choose to send.
• Bookings: the traveller details, emergency contact, dietary or medical information relevant to the trip, and documentation needed for travel arrangements.

2.2 Data collected automatically

• Technical data needed to serve the site and keep it secure: IP address, browser and device type, pages visited, referring page, and timestamps.
• Cookie and consent records: the choices you make in our cookie banner, stored with a hashed version of your IP address and browser signature so we can prove when consent was given or withdrawn. We do not store the raw IP address in that record.
• Measurement data from the analytics and advertising tools listed in our Cookie Policy, only when you have accepted the relevant category.

2.3 Data from third parties

• Our booking provider (WeTravel) confirms your booking and payment status to us; we never receive your full card details.
• Advertising and social platforms give us aggregated campaign statistics, and where you interact with our ads or profiles, the contact data you chose to share with them.

3. Why we use your data, and on what legal basis

• To answer your enquiries and give you information about our trips. Legal basis: your request and steps taken at your request prior to a contract (GDPR art. 6.1.b), or our legitimate interest in responding (art. 6.1.f).
• To manage waitlists and notify you when a departure opens. Legal basis: your consent (art. 6.1.a).
• To send you our newsletter and marketing emails. Legal basis: your consent, or our legitimate interest in contacting existing customers about trips similar to the one they booked (the soft opt-in of the ePrivacy Directive art. 13.2, implemented in Estonia by the Electronic Communications Act). Every email includes an unsubscribe link.
• To organise, deliver and administer a trip you have booked, including sharing what is strictly necessary with accommodation, transport and local partners. Legal basis: performance of the contract (art. 6.1.b).
• To comply with accounting, tax, consumer and travel-industry obligations. Legal basis: legal obligation (art. 6.1.c).
• To keep the site secure, prevent fraud and abuse of our forms, and prove cookie consent. Legal basis: legitimate interest and legal obligation (arts. 6.1.f and 6.1.c).
• To measure and improve our advertising, including audiences and conversion measurement on Meta platforms. Legal basis: your consent given through the cookie banner (art. 6.1.a).
• Health or dietary information given for a trip is special-category data and is processed only with your explicit consent (art. 9.2.a), solely to make the trip safe and suitable for you.

4. Who we share your data with

We do not sell your data. We share it only with providers who process it on our instructions under a data processing agreement, and with authorities when the law requires it. Our main processors are:

• Brevo (Sendinblue): email, CRM and marketing automation.
• WeTravel: bookings and payment processing.
• Cloudflare: hosting, content delivery, bot protection and cookieless web analytics.
• Sanity: content management for the website.
• Google (Tag Manager, and Analytics if enabled): tag management and site measurement.
• Meta Platforms Ireland: advertising measurement and audiences, only with your marketing consent.
• Trip partners: accommodation, guides, instructors, insurers and transport providers strictly for the trip you booked.
• Professional advisers: accountants, lawyers or auditors, where necessary and bound by confidentiality.

5. International transfers

Some of the providers above are based outside the European Economic Area or may access data from third countries. In those cases the transfer relies on an adequacy decision, on the European Commission’s Standard Contractual Clauses, or on the EU-US Data Privacy Framework, together with additional technical measures such as encryption and pseudonymisation. You can request a copy of the safeguards at hello@magandaexperience.com.

6. How long we keep your data

• Enquiries that do not lead to a booking: up to 2 years from the last contact.
• Waitlist and newsletter data: until you withdraw consent or unsubscribe, and up to 3 years of inactivity after that.
• Booking and billing records: 6 years for commercial and accounting obligations, and up to 10 years where tax or anti-money-laundering rules require it.
• Cookie consent records: 3 years from the moment consent was given or withdrawn, as evidence of compliance.
• Health or dietary information provided for a trip: deleted within 6 months of the trip ending, unless a claim is pending.

After these periods the data is deleted or anonymised, or kept blocked and inaccessible strictly for as long as legal liabilities may arise.

7. Your rights

You can exercise the following rights free of charge at any time:

• Access: obtain a copy of the data we hold about you.
• Rectification: correct data that is inaccurate or incomplete.
• Erasure: ask us to delete your data when it is no longer necessary.
• Restriction: ask us to pause processing while a dispute is resolved.
• Objection: object to processing based on legitimate interest, including profiling for marketing.
• Portability: receive the data you gave us in a structured, machine-readable format.
• Withdraw consent: at any time, without affecting processing already carried out.

Write to hello@magandaexperience.com with the subject "Data protection", stating the right you wish to exercise. We may ask for proof of identity. We answer within one month, extendable by two further months for complex requests.

If you believe we have not handled your data correctly, you may complain to our supervisory authority, the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn, Estonia, www.aki.ee), or to the data protection authority of the EU country where you live or work.

8. Automated decisions and profiling

We do not take decisions with legal or similarly significant effects about you by purely automated means. When you accept marketing cookies, we do build advertising audiences based on your interaction with the site so our campaigns reach people with similar interests; you can stop this at any time from "Cookie settings" in the footer.

9. Security

The site is served over HTTPS, our forms are protected against automated abuse, access to personal data is restricted to the people who need it, and IP addresses in our consent records are stored only as irreversible hashes. If a breach occurs that is likely to result in a high risk to your rights, we will notify you and the supervisory authority as required by law.

10. Minors

Our trips and this website are aimed at adults. We do not knowingly collect data from anyone under 18. If you believe a minor has given us data, contact us and we will delete it.

11. Cookies

Our use of cookies and similar technologies, including the full list of providers and retention periods, is described in our Cookie Policy. You can change or withdraw your consent at any time from "Cookie settings" in the footer.

12. Changes to this policy

We may update this policy when our services, providers or legal obligations change. The date shown at the top of this page is always the date of the version in force, and we will tell you about substantial changes by email or through a notice on the site.