Privacy
Your family's details exist to build your guide. Nothing more.
This policy explains how we collect, use, retain and protect personal data in connection with the free city guides, the questionnaire and the guides we produce. We process personal data in accordance with the General Data Protection Regulation and applicable Dutch law.
1. Data controller
The controller is Northcliff Journeys, a business line of Northcliff AI, a registered trading name of Spark GTM Consulting (KvK 90876385), Amsterdam, the Netherlands.
We are not required to appoint a data protection officer and have not done so. All privacy enquiries should be sent to hello@northcliffjourneys.com.
2. Personal data we process
2.1 Data you provide
| Category | What it covers |
|---|---|
| Identity and contact data | Your family name and email address. |
| Trip data | Destinations, travel dates, the type of trip, the places you are staying and what you have already arranged. |
| Household data | The number of adults and children travelling, and an age band for each child. |
| Special category data | Limited health and accessibility information, as described in section 3. |
| Preference data | How your days run, what you want the trip to include, and free-text answers you choose to give. |
| Transaction data | Confirmation of payment, the tier purchased and the associated identifiers. Card details are handled by our payment processor and are never received or stored by us. |
Requesting a free city guide collects your email address and, if you choose to give it, the month you intend to travel. Nothing else is asked for and no payment is involved. You may also tick a box asking for occasional emails; the guide is sent either way.
2.2 Data generated by your use
Our hosting providers record standard server log data, including the resource requested, the time of the request, an IP address and browser and device information. This is processed to operate and secure the service.
2.3 Data from third parties
Our payment processor confirms payment status and provides transaction identifiers. We do not receive card details from it.
3. Special category data
Two questions in the questionnaire may elicit information concerning health or disability. These are the question concerning any person you would like us to plan around, and the question concerning allergies and intolerances. Information of this kind is special category data under Article 9 of the GDPR.
We process it solely to determine which places are included in a shortlist and how a day is structured. It is not published in any guide, is not disclosed outside the persons producing your guide, and is not used for any other purpose.
Our legal basis is your explicit consent under Article 9(2)(a). Consent is requested at the point of collection: in the questionnaire, by a separate question presented only where such an answer has been given. You may decline and still use the service. You may withdraw consent at any time by writing to us, in which case the relevant data is deleted. Withdrawal does not affect the lawfulness of processing carried out before it.
Age bands relating to children are processed on the basis set out in section 5 and are not treated as special category data.
4. Data we do not collect
- Names or dates of birth of children.
- Passport, identity document or booking reference numbers.
- Payment card numbers.
- Your home address.
- Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, or data concerning sex life or sexual orientation.
We do not sell, rent or otherwise trade personal data, and we do not accept payment or other consideration in return for including a place in a guide.
5. Purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Producing and delivering your guide | Identity, trip, household and preference data | Performance of a contract, Art. 6(1)(b) |
| Selecting places compatible with stated health or accessibility needs | Special category data | Explicit consent, Art. 9(2)(a) |
| Processing payment and issuing receipts and refunds | Identity and transaction data | Performance of a contract, Art. 6(1)(b) |
| Correspondence concerning your order | Contact data | Performance of a contract, Art. 6(1)(b) |
| Sending a free city guide you asked for | Contact data and, where given, intended travel month | Consent, Art. 6(1)(a) |
| Marketing communications | Contact data | Consent, Art. 6(1)(a), withdrawable at any time |
| Responding to enquiries, resolving disputes and securing the service | Correspondence and server log data | Legitimate interests, Art. 6(1)(f) |
| Accounting and tax compliance | Transaction data | Legal obligation, Art. 6(1)(c) |
We do not carry out profiling or automated decision-making producing legal or similarly significant effects.
6. Recipients and processors
6.1 Categories of processor
We disclose personal data to service providers who process it on our instructions and for no other purpose, under written terms requiring appropriate safeguards.
| Category | Purpose | Location |
|---|---|---|
| Payment processing | Payment, receipts and refunds | EU and United States |
| Form and survey platform | Hosting the questionnaire and storing responses | EU |
| Email delivery and list management | Sending free city guides and any marketing emails you consent to, and storing the subscriber record | United States |
| Automation platform | Passing a free guide signup from the form to the email platform | EU |
| Website and guide hosting | Serving this site and your guide | EU and United States |
| Cloud storage and version control | Storing working files and correspondence | EU and United States |
| AI research tools | The processing described in section 8 | United States |
| Mapping and place data | Verifying locations, opening hours and travel times | United States |
| Email and domain services | Receiving correspondence sent to our contact address | United States |
A current list of the individual processors engaged within each category is available on request.
6.2 Legal and regulatory disclosure
We may retain or disclose personal data where required by law or in response to a lawful request from a court or competent authority, and where reasonably necessary to detect or prevent fraud or unlawful activity or to protect the rights, property or safety of any person.
6.3 Business transfers
If the business is sold, merged or otherwise transferred, personal data may transfer with it. You will be notified before any different privacy policy applies to you.
7. Cookies and similar technologies
Nothing on this site sets a cookie or contacts anyone else until you ask it to. Two things can, and each needs an action from you first.
Measurement, if you allow it. A bar at the foot of the screen asks whether we may load two tools. One is Meta's advertising pixel, which tells us which advertisement brought you here. The other is our visitor statistics, which tells us which pages are read and in what order. Both set cookies in your browser, and both are loaded from this domain. Neither is loaded unless you choose Allow. If you choose No thanks, or make no choice at all, neither is loaded and no request is made to either.
Your answer is stored in your browser so we do not ask again. Clearing your browser storage for this site causes the question to be asked once more, and that is also how you withdraw consent, along with writing to us at the address in section 1.
Where consent is the lawful basis, it is consent under Article 6(1)(a), and it is not a condition of using this site or of buying anything from us. We do not use these tools to build a profile of you or to reach you anywhere other than through advertising you may see on Meta's platforms.
The site also stores a single value recording that you dismissed the bar at the foot of the screen. It contains no personal data.
8. Automated tools and AI processing
We use research tools, including AI models, in the course of researching and drafting guides. Questionnaire responses are processed by those tools as part of producing your guide, and are accordingly disclosed to the AI provider identified in section 6.
The provider does not use this data to train its models under the terms on which we engage it. We will update this section if that position materially changes. Payment data is never processed by these tools.
Output produced by these tools is not published without verification against a live source and human review. If you would prefer your questionnaire not to be processed in this way, contact us before completing it.
9. Your guide
Each guide is published to a private address that is not linked publicly, is not indexed by search engines and is protected by a passphrase issued to you. Distribution of that address and passphrase is within your control.
No personal data relating to your household is published within a guide. This includes names, ages, dates of birth, addresses, booking references and any health or accessibility information. Exclusion is enforced by the software that produces the guide rather than by manual review.
Guides are hosted for 12 months from delivery and are then deleted. A guide refunded under section 3 of the refund policy is deleted 14 days after the refund is confirmed. A guide already loaded on a device continues to function offline after deletion, with no connection to us.
10. Retention
| Category | Retention period |
|---|---|
| Questionnaire responses and research records | 12 months after the end of your trip |
| Hosted guides | 12 months from delivery, or 14 days from confirmation of a refund |
| Free guide subscriber records | Until you unsubscribe or ask us to delete them |
| Quiz responses | 12 months from submission |
| Correspondence | 24 months from the last message |
| Marketing contact details | Until consent is withdrawn |
| Payment and accounting records | 7 years from the transaction, as required by Dutch tax law. This period applies notwithstanding any earlier erasure request |
| Backup copies | Up to 90 days following deletion |
Personal data is erased on request in advance of these periods, save where retention is required by law.
11. Security
We apply appropriate technical and organisational measures, including encryption in transit, access controls limiting access to authorised personnel, and the use of providers offering encryption at rest. Payment card data is handled exclusively by our payment processor and is never received by us.
No system is entirely secure and no absolute guarantee of security can be given. Where a personal data breach is likely to result in a high risk to your rights and freedoms, we will notify you as required by Article 34 of the GDPR.
12. Your rights
| Right | Scope |
|---|---|
| Access | Obtain confirmation of processing and a copy of the personal data held. |
| Rectification | Have inaccurate or incomplete data corrected. |
| Erasure | Have personal data deleted, subject to statutory retention obligations. |
| Portability | Receive data provided to us in a structured, machine-readable format. |
| Restriction | Require processing to be restricted in the circumstances set out in Article 18. |
| Objection | Object to processing carried out on the basis of legitimate interests. |
| Withdrawal of consent | Withdraw consent at any time where processing is based on it, without affecting prior lawful processing. |
Requests should be sent to hello@northcliffjourneys.com. We respond within one month of receipt. We may request information reasonably necessary to verify your identity before acting on a request.
You have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens, at autoriteitpersoonsgegevens.nl, or with the supervisory authority in your place of residence.
13. International transfers
We are established in the Netherlands. Certain processors identified in section 6 are established in, or process data in, the United States. Where personal data is transferred outside the European Economic Area, that transfer is made under the Standard Contractual Clauses approved by the European Commission or another lawful transfer mechanism.
14. Children's data
The service is offered to adults and is not directed at children. We do not knowingly contract with, or collect personal data directly from, any person under 18.
We do process limited personal data relating to children, provided by a parent or guardian, consisting of an age band and information relevant to planning, such as sleep patterns and, where consent is given under section 3, dietary or accessibility needs. We do not collect children's names or dates of birth and we do not publish any data relating to a child. A parent or guardian may request erasure of that data at any time.
15. Third party links
This site and the guides we produce contain links to third party services, including sources cited for each place and mapping services used for directions. This policy does not apply to those services, which are governed by their own privacy policies.
16. Changes to this policy
Material changes will be notified by email, at least 30 days before they take effect, to persons for whom we are producing or have produced a guide. Clarifications and corrections may be published without prior notice. The version and effective date above identify the current version.
17. Contact
Northcliff Journeys, a business line of Northcliff AI, a registered trading name of Spark GTM Consulting.
Amsterdam, the Netherlands · KvK: 90876385
hello@northcliffjourneys.com
Also worth reading
The terms that apply when you order a guide, and the refund policy.