Privacy Notice — TCI Culture and Island Guide

1. Who we are

This Privacy Notice is issued by TCI culture and island guide ("we", "us", "our"), the operator of the TCI Island Guide application (the "Service"). We act as the data controller for personal data processed in connection with the Service.

2. Personal data we collect

Account data: email address, password (hashed), and authentication identifiers when you sign up or sign in (including via Google).
Entitlement data: a record of any in-app purchases you make (e.g. Explorer Pass) so we can grant you access.
Usage and device data: IP address, browser/device information, and basic interaction logs used for security, fraud prevention, and product improvement.
Support communications: messages you send us when requesting help.

Payment card details are not collected or stored by us. They are handled directly by our reseller, Paddle (see Section 5).

3. Why we use your data and legal basis

Provide the Service (account creation, granting purchased access) — performance of contract.
Security and fraud prevention — legitimate interests.
Customer support — performance of contract / legitimate interests.
Product improvement and analytics — legitimate interests.
Legal compliance — legal obligation.

4. Cookies

We use essential cookies and similar storage to keep you signed in and to remember your session. We do not use advertising cookies.

5. Sharing your data

We share personal data only with the following categories of recipients:

Hosting and infrastructure providers who host the Service and database on our behalf.
Paddle.com Market Limited (Paddle), our Merchant of Record, who handles checkout, payment processing, billing, tax compliance, invoicing, refunds, and related customer service for purchases. See Paddle's privacy notice at paddle.com/legal/privacy.
Authentication providers (e.g. Google) when you choose to sign in via OAuth.
Professional advisers (legal, accounting) when strictly necessary.
Authorities where required by applicable law.

6. International transfers

Some of our service providers are located outside your country of residence. Where personal data is transferred internationally, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.

7. Retention

We retain personal data for as long as your account is active and for a reasonable period afterwards to comply with legal obligations, resolve disputes, and enforce our agreements. Purchase records are kept for the period required by tax and accounting laws. Data that is no longer needed is deleted or anonymised.

8. Your rights

Subject to applicable law, you have the right to access, rectify, erase, restrict or object to processing of your personal data, to data portability, and to withdraw consent at any time. You may also lodge a complaint with your local data protection authority. To exercise any right, contact us at the address below — we aim to respond within one month.

9. Security

We implement appropriate technical and organisational measures, including encryption in transit, access controls, and secure authentication, to protect your personal data against unauthorised access, loss or alteration.

10. Contact

For privacy questions or to exercise your rights, contact TCI culture and island guide through the support channel available in the app.