Privacy Policy

1. Data Controller

The Clubbe LLC ("The Clubbe", "we", "us", "our") is the data controller responsible for processing your personal data. We are incorporated in the United States of America and operate travel services internationally.

2. Information We Collect

We collect the following categories of personal data:

3. Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Performance of a contract: to process your bookings, manage payments, and provide the requested travel services.
• Consent: to send marketing communications, promotional offers, and newsletters. You may withdraw your consent at any time.
• Legitimate interest: to improve our services, prevent fraud, and ensure the security of our platform.
• Legal obligation: to comply with regulatory, tax, and anti-money laundering requirements.

4. How We Use Your Information

• Process and manage your flight, accommodation, experience, cruise, and travel package bookings.
• Communicate with you about your bookings, itinerary changes, and service updates.
• Process payments and issue invoices and quotes.
• Provide customer service and concierge support.
• Personalize your travel experience and send relevant recommendations.
• Comply with applicable legal and regulatory obligations.
• Improve our website, products, and services through aggregated analytics.

5. Information Sharing

We do not sell your personal data. We may share your information with:

• Travel service providers: airlines, hotels, tour operators, cruise lines, and transport companies to fulfill your bookings.
• Payment processors: to process transactions securely (e.g., Stripe).
• Technology providers: web hosting, database, and analytics tools (e.g., Supabase, Vercel).
• Government authorities: when required by law, legal process, or valid governmental request.

6. International Data Transfers

As we operate internationally, your personal data may be transferred to and processed in countries other than your own, including the United States, Canada, and Ecuador. These transfers are made to fulfill our travel services and are protected by appropriate security measures, including standard contractual clauses and compliance with applicable data protection laws in each jurisdiction. In compliance with Ecuador's Organic Law on Personal Data Protection (LOPDP), international transfers are made only when the receiving country ensures an adequate level of protection or when appropriate safeguards are in place.

7. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes described in this policy, unless a longer retention period is required or permitted by law. In general:

• Booking and transaction data: 7 years (tax and accounting obligations).
• User account data: while your account remains active, plus 2 years after closure.
• Marketing data: until you withdraw your consent.
• Technical and cookie data: maximum 13 months.

8. Cookies and Tracking Technologies

Our website uses cookies and similar technologies to:

• Essential cookies: necessary for site functionality (authentication, language preferences).
• Analytics cookies: to understand how users interact with our site and improve the experience.
• Functional cookies: to remember your preferences and personalize your experience.

You can configure your browser to reject cookies, although this may affect site functionality.

9. Your Rights

Under applicable data protection laws (including CCPA in the United States, PIPEDA in Canada, and LOPDP in Ecuador), you have the following rights:

10. U.S. Residents' Rights (CCPA/CPRA)

If you are a resident of California or other states with similar privacy laws, you have additional rights:

• Right to know what personal data we collect, use, share, and sell.
• Right to request deletion of your personal data.
• Right to opt out of the sale of personal data. The Clubbe does not sell personal data.
• Right to non-discrimination for exercising your privacy rights.

In the past 12 months, we have NOT sold consumers' personal data. The categories of data we collect are described in Section 2 of this policy.

11. Canadian Residents' Rights (PIPEDA)

In compliance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA):

• We obtain your meaningful consent before collecting, using, or disclosing your personal information.
• We collect only the information necessary for the identified purposes.
• You can access and request correction of your personal information in our records.
• You may file a complaint with the Privacy Commissioner of Canada if you believe we have handled your information inappropriately.
• You may withdraw your consent at any time, subject to legal or contractual restrictions.

12. Ecuadorian Residents' Rights (LOPDP)

In compliance with Ecuador's Organic Law on Personal Data Protection:

• You have the right to be informed about the processing of your data in a clear, precise, and accessible manner.
• You have the right to access, rectify, update, delete, object to, and request portability of your data.
• You have the right not to be subject to automated individual decisions without human intervention that produce legal effects.
• You may file complaints with the Ecuadorian Personal Data Protection Authority.
• Your sensitive data (health, biometric data) will only be processed with your explicit consent.

13. How to Exercise Your Rights

To exercise any of your rights, you may contact us through:

14. Children's Privacy

Our services are not directed at individuals under 18 years of age. We do not knowingly collect personal data from minors without the consent of their parents or legal guardians. For bookings that include minors, data will be provided and authorized by their legal representative. If we discover that we have collected data from a minor without proper parental consent, we will take steps to delete that information.

15. Data Security

We implement appropriate technical, administrative, and physical security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include encryption of data in transit and at rest (TLS/SSL, AES-256), secure authentication, role-based access controls, and continuous security monitoring. However, no method of Internet transmission or electronic storage is 100% secure.

16. Data Breach Notification

In the event of a security breach affecting your personal data, we will notify you without undue delay, in accordance with applicable laws. In compliance with PIPEDA, we will notify the Privacy Commissioner of Canada and affected individuals when there is a real risk of significant harm. Under Ecuador's LOPDP, we will notify the Data Protection Authority within the legally established timeframes.

17. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices or applicable legislation. We will notify you of significant changes through our website or by email. We encourage you to review this policy regularly. The "Last updated" date at the top of this page indicates when the most recent revision was made.

18. Contact Us

If you have questions, concerns, or complaints about this Privacy Policy or the processing of your personal data, please do not hesitate to contact us: