Last Updated: July 5, 2026
This Privacy Policy explains how Purpose Labs, S.L. (“Charitrip,” “Company,” “we,” “us,” or “our“), the company behind the Charitrip brand, collects, uses, shares, and protects personal data when you use our website and platform at charitrip.world (the “Service“).
This Policy should be read together with our Terms & Conditions and our Cookie Policy.
1. Data Controller
Purpose Labs, S.L. Calle Pedro y Gun Vandale, 19, 96A, 35660, Corralejo, Las Palmas, Spain Email: rosario@charitrip.world
We have not appointed a Data Protection Officer, as it is not mandatory given the size and nature of our activity. All privacy-related requests can be sent to the email address above.
2. What Charitrip Does (Context for This Policy)
Charitrip is a marketplace that connects travelers with independent third-party providers (“Providers“) — including NGOs, charities, and social-impact hosts — who offer tourism experiences and accommodation packages. Access to the Platform is provided through a paid subscription, processed via our payment provider, Stripe. Charitrip does not process payment for the trips or accommodation booked with Providers; that payment is made directly between the Traveler and the Provider.
This context matters for this Policy because some of your personal data may need to be shared with Providers so that a booking or enquiry can be fulfilled — see Section 8.
3. Legal Basis for Processing (Article 6 GDPR)
We process personal data under one or more of the following legal bases:
- Consent (Art. 6(1)(a)) — e.g., for marketing emails and non-essential cookies
- Contract performance (Art. 6(1)(b)) — e.g., to manage your account and Subscription
- Legal obligation (Art. 6(1)(c)) — e.g., tax and accounting records
- Legitimate interest (Art. 6(1)(f)) — e.g., to improve and secure the Platform, prevent fraud
4. Personal Data We Collect
Identity Data
- Full name
- Username
- Organization name (if applicable, e.g., for Providers)
Contact Data
- Email address
- Phone number
- Social media handles
Account & Subscription Data
- Account credentials
- Subscription plan and billing status (payment card details are processed and stored directly by Stripe; we do not store full card numbers)
Technical Data
- IP address
- Device type and browser information
- Cookies and similar identifiers
Usage & Tracking Data
- Pages visited, time on page, click behavior
- Session recordings and heatmap interactions
- Source of traffic and campaign attribution (UTM parameters)
Communication Data
- Messages sent through contact or enquiry forms
- Email correspondence
- Interactions on our social media channels
5. Tracking Technologies and Analytics Tools We Use
We currently use the following third-party tools to operate, analyze, and improve the Platform:
| Tool | Purpose |
|---|---|
| Google Analytics | Website traffic and usage analytics |
| Meta Pixel (Facebook/Instagram) | Advertising performance and conversion tracking |
| Mailchimp / Klaviyo (email marketing CRM) | Sending transactional and marketing emails, managing subscriber lists |
| VWO | A/B testing and website optimization |
| Microsoft Clarity | Session recordings and heatmaps to understand user behavior |
These tools may collect data such as pages visited, click behavior, device information, and campaign source. Non-essential tracking (e.g., Meta Pixel, VWO, Microsoft Clarity, and Google Analytics where applicable) is only activated after you provide consent through our cookie banner. You can withdraw consent at any time — see our Cookie Policy for details on how to manage your preferences.
6. Email Communications
Charitrip sends emails from our own domain (e.g., @charitrip.world). We send two types of emails:
- Transactional emails (e.g., account confirmation, billing receipts, service updates, password resets) — sent as part of operating your account and Subscription; these are not optional while you hold an active account.
- Marketing emails (e.g., newsletters, new Provider announcements, promotions) — sent only if you have given explicit consent. You may unsubscribe at any time using the link included in each marketing email or by contacting us directly.
7. How We Use Your Data
We use personal data to:
- Create and manage your account and Subscription
- Process payments (via Stripe) and manage billing
- Facilitate connections and enquiries between Travelers and Providers
- Respond to enquiries and provide customer support
- Send transactional and, where consented, marketing communications
- Analyze and improve the Platform’s performance and user experience
- Detect, prevent, and address fraud, abuse, or security issues
- Comply with legal and tax obligations
8. Sharing of Data
We do not sell personal data.
We may share personal data with:
- Providers, when you make an enquiry or booking through the Platform, to the extent necessary for them to respond to you or fulfill the experience/accommodation package
- Payment processors (Stripe), to process your Subscription payment
- Hosting providers, to operate the website and store data securely
- Analytics and marketing tool providers listed in Section 5
- Legal or governmental authorities, when required by law or to protect our rights
All third-party processors that handle personal data on our behalf operate under GDPR-compliant Data Processing Agreements (DPAs).
9. International Data Transfers
Some of our service providers (e.g., analytics, email marketing, or hosting tools) may process data outside the European Economic Area (EEA). Where this occurs, we ensure appropriate safeguards are in place, such as:
- Standard Contractual Clauses (SCCs)
- Adequacy decisions issued by the European Commission
- Other legally recognized transfer mechanisms
10. Data Retention
We retain personal data:
- For as long as your account remains active
- For as long as necessary to fulfill contractual or legal obligations (e.g., invoicing, tax records)
- Until you request deletion of your data
Inactive accounts are deleted after 1 year of inactivity, unless a longer retention period is required by law.
11. Your Rights Under GDPR
If you are located in the European Economic Area (or in any jurisdiction granting equivalent rights), you have the right to:
- Access the personal data we hold about you
- Rectify inaccurate or incomplete data
- Erase your data (“right to be forgotten”)
- Restrict processing in certain circumstances
- Data portability, to receive your data in a structured, machine-readable format
- Object to processing based on legitimate interest or for direct marketing
- Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal
- Lodge a complaint with your national Data Protection Authority — in Spain, the Agencia Española de Protección de Datos (AEPD)
To exercise any of these rights, contact us at rosario@charitrip.world.
12. Global Users
Charitrip is available to users worldwide. Regardless of your location, we apply the data protection standards described in this Policy to all users of the Platform. If you access the Service from outside the EEA, your data will be transferred to and processed in Spain and, where applicable, by the third-party providers listed in Section 5, under the safeguards described in Section 9.
13. Security Measures
We implement reasonable technical and organizational measures to protect personal data, including:
- SSL/TLS encryption
- Firewall protection
- Role-based access controls
- Secure hosting infrastructure
- Password protection
- Limited internal access to personal data on a need-to-know basis
No system can be guaranteed 100% secure, and we cannot fully warrant the absolute security of information transmitted to us.
14. Children’s Privacy
The Service is not directed at children, and we do not knowingly collect personal data from individuals without the legal capacity to enter into a contract in their jurisdiction. If you believe a child has provided us with personal data, please contact us so we can take appropriate action.
15. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify users of significant changes via email or a notice on the Platform. Continued use of the Service after changes take effect constitutes acceptance of the updated Policy.
16. Contact Us
For any questions about this Privacy Policy or to exercise your data protection rights, contact:
Purpose Labs, S.L. Calle Pedro y Gun Vandale, 19, 96A, 35660, Corralejo, Las Palmas, Spain rosario@charitrip.world