PRIVACY POLICY
1. Data Controller
The Data Controller for this website is:
Zancanaro Beatrice
Via Sestri Levante 40/5, 41125 Modena (MO), Italy
VAT number: IT04046990364
Email: info@cluegovisit.com
Certified email (PEC): info@beatricezancanaro.com
ClueGo has not appointed a Data Protection Officer (DPO), as it is not required to do so under Article 37 of the GDPR.
2. What personal data we collect
We collect the following categories of personal data:
• Identification data (first name, last name)
• Contact data (email address)
• Payment data (processed exclusively by third-party providers: Stripe, PayPal — we do not store card details
• Usage data: trail progression, puzzle interactions, session duration and timestamps
• Browsing data: IP address, cookies, access logs
• User-generated content (UGC): reviews, comments, photos or other materials voluntarily submitted
Providing data required to complete a purchase is mandatory — without it, we cannot process your order or grant access to the trail. Providing data for marketing purposes is optional.
3. Purposes and legal bases for processing
a) Delivering the service
Processing your order, issuing the access code and enabling use of the ClueGo trail.
Legal basis: performance of a contract (Art. 6(1)(b) GDPR)
b) Payment processing
Handled by Stripe and PayPal. ClueGo does not process or store payment card data directly.
Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
c) Analytics
We use Google Analytics 4 to understand how users interact with the website and to improve our service.
Legal basis: consent (Art. 6(1)(a) GDPR).
d) Marketing and newsletter
Sending promotional communications via Brevo (formerly Sendinblue), only where you have opted in.
Legal basis: consent (Art. 6(1)(a) GDPR), which can be withdrawn at any time.
e) Website operation and security
Hosting and infrastructure via Squarespace. Prevention of fraud and unauthorised access.
Legal basis: legitimate interests of the Data Controller (Art. 6(1)(f) GDPR), consisting in ensuring the correct functioning and security of the website.
f) Embedded media
Displaying videos via YouTube (Google LLC).
Legal basis: consent (Art. 6(1)(a) GDPR).
g) User-generated content (UGC)
Publishing reviews, testimonials or images submitted by users, subject to explicit prior authorisation. You may request removal at any time by contacting info@cluegovisit.com
Legal basis: consent (Art. 6(1)(a) GDPR).
4. Automated decision-making and profiling
Your personal data is not subject to automated decision-making or profiling within the meaning of Article 22 GDPR.
Google Analytics 4 processes data in aggregated and pseudonymised form, which does not allow direct identification of individual users. This data is not used to profile individuals.
5. How we process your data
Personal data is processed using electronic systems, in accordance with the principles of lawfulness, fairness, transparency, data minimisation, and security as required by the GDPR. We implement appropriate technical and organisational measures to prevent unauthorised access, loss or disclosure.
6. Retention periods
• Contractual and tax records: 10 years from the date of the relevant fiscal document, as required by Italian tax law
• Customer support data: up to 24 months from the closure of the request
• Marketing / newsletter data: until withdrawal of consent
• Usage and analytics data: in accordance with the policies of the relevant providers (e.g. GA4 default: 14 months)
• User-generated content: until a deletion request is received
7. International data transfers
Some personal data may be transferred to countries outside the European Economic Area (EEA), in particular to the United States, via services such as Google LLC and YouTube.
All such transfers are carried out in accordance with the safeguards required under GDPR, specifically:
• The European Commission's adequacy decision in respect of the EU-US Data Privacy Framework (DPF), pursuant to Art. 45 GDPR
• Standard Contractual Clauses (SCCs) approved by the European Commission, pursuant to Art. 46 GDPR
For further information on data transfers by individual providers, please refer to their respective privacy policies.
8. Data processors (sub-processors)
The following entities process personal data on behalf of ClueGo, acting as data processors under Article 28 GDPR:
• Squarespace Inc. — website hosting and infrastructure
• Stripe Inc. — payment processing
• PayPal Holdings Inc. — payment processing
• Google LLC (Google Analytics 4, YouTube) — analytics and embedded media
• Brevo SAS (formerly Sendinblue) — newsletter and email communications
This list may be updated over time. The most current version will always be available on this page.
9. Your rights
Under Articles 15-22 GDPR, you have the right to:
• Access your personal data (Art. 15)
• Obtain rectification of inaccurate data (Art. 16)
• Request erasure of your data (Art. 17)
• Restrict processing (Art. 18)
• Receive your data in a structured, machine-readable format (data portability, Art. 20)
• Object to processing (Art. 21)
• Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal (Art. 7(3))
To exercise any of these rights, please contact us at:
You also have the right to lodge a complaint with the competent supervisory authority:
Italian Data Protection Authority (Garante per la protezione dei dati personali) — www.garanteprivacy.it
10. Children
Our service may be used by minors under the supervision of an adult. ClueGo does not knowingly collect personal data from children under the age of 18 without the consent of a parent or legal guardian.
If we become aware that we have inadvertently collected data from a minor without the required consent, we will delete it promptly. Parents or guardians may request deletion by contacting info@cluegovisit.com.
11. Changes to this policy
This Privacy Policy may be updated to reflect regulatory or operational changes. In the event of material changes, registered users will be notified by email. The latest version will always be available on this page.
12. Last updated
April 2026