PRIVACY POLICY Last updated: August 2026
1. Data Controller
The Data Controller for this website is:
Zancanaro Beatrice
Via Sestri Levante 40/5, 41125 Modena (MO), Italy
VAT number: IT04046990364 — REA MO-449092
Email: info@cluegovisit.com
ClueGo has not appointed a Data Protection Officer (DPO), as it is not required to do so under Article 37 GDPR.
2. Personal data we collect
The website and Web App collect the following categories of personal data:
• Identification data (first name, last name)
• Contact data (email address)
• Payment data (processed exclusively by third-party providers: Stripe, PayPal — ClueGo does not store card details)
• Usage data: trail progression, puzzle interactions, session duration and timestamps
• Browsing data: IP address, cookies, access logs
• Account data: email address and password (stored in encrypted form), trail history and personal preferences — collected only upon voluntary registration
• Photographs (selfies): images optionally taken by the user via the Web App during a trail, subject to explicit prior consent
• User-generated content (UGC): reviews, comments or other materials voluntarily submitted
Providing data required to complete a purchase is mandatory — without it, we cannot process your order or grant access to the trail. Providing data for marketing purposes, creating an account, and taking a selfie are all optional.
3. Purposes and legal bases for processing
a) Delivering the service
Processing your order, issuing the access code and enabling use of the ClueGo trail.
Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
b) Payment processing
Handled by Stripe and PayPal. ClueGo does not process or store payment card data directly.
Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
c) Analytics
We use Google Analytics 4 to understand how users interact with the website and to improve our service.
Legal basis: consent (Art. 6(1)(a) GDPR).
d) Marketing and newsletter
Sending promotional communications via Brevo (formerly Sendinblue), only where you have opted in.
Legal basis: consent (Art. 6(1)(a) GDPR), which can be withdrawn at any time.
e) Website operation and security
Hosting and infrastructure via Squarespace. Prevention of fraud and unauthorised access.
Legal basis: legitimate interests of the Data Controller (Art. 6(1)(f) GDPR).
f) Embedded media
Displaying videos via YouTube (Google LLC).
Legal basis: consent (Art. 6(1)(a) GDPR).
g) User-generated content (UGC)
Publishing reviews, testimonials or images submitted by users, subject to explicit prior authorisation. You may request removal at any time by contacting info@cluegovisit.com.
Legal basis: consent (Art. 6(1)(a) GDPR).
h) Photographs taken during the trail (selfies)
Saving and displaying a photograph optionally taken by the user during a trail via the Web App, as a personal memento. The photo is shown during and at the end of the trail and can be downloaded to the user's device.
Legal basis: consent (Art. 6(1)(a) GDPR).
i) Account management
Creating and managing the user's personal profile, storing trail history and preferences. Registration is optional.
Legal basis: performance of a contract / pre-contractual measures (Art. 6(1)(b) GDPR).
4. Automated decision-making and profiling
Your personal data is not subject to automated decision-making or profiling within the meaning of Article 22 GDPR.
Google Analytics 4 processes data in aggregated and pseudonymised form, which does not allow direct identification of individual users. This data is not used to profile individuals.
5. How we process your data
Personal data is processed using electronic systems, in accordance with the principles of lawfulness, fairness, transparency, data minimisation, and security as required by the GDPR. We implement appropriate technical and organisational measures to prevent unauthorised access, loss or disclosure.
6. Retention periods
• Contractual and tax records: 10 years from the date of the relevant fiscal document
• Customer support data: up to 24 months from the closure of the request
• Marketing / newsletter data: until withdrawal of consent
• Usage and analytics data: in accordance with the policies of the relevant providers (e.g. GA4 default retention: 14 months)
• User-generated content: until a deletion request is received
• Photographs (selfies): for the duration of the active Account, plus 12 months from Account deletion, unless the user requests earlier deletion, which will be processed within 7 business days
• Account data: for the duration of the active account, plus 12 months from deletion, after which permanent erasure takes place
7. International data transfers
Some personal data may be transferred to countries outside the European Economic Area (EEA), in particular to the United States, via services such as Google LLC and YouTube.
All such transfers are carried out subject to appropriate safeguards under the GDPR, specifically:
• The European Commission's adequacy decision in respect of the EU-US Data Privacy Framework (DPF), pursuant to Art. 45 GDPR
• Standard Contractual Clauses (SCCs) approved by the European Commission, pursuant to Art. 46 GDPR
For further information on data transfers by individual providers, please refer to their respective privacy policies.
8. Data processors (sub-processors)
The following entities process personal data on behalf of ClueGo as data processors within the meaning of Article 28 GDPR:
• Squarespace Inc. — website hosting and infrastructure
• Bubble.io (Bubble Group Inc.) — Web App infrastructure and selfie storage
• Stripe Inc. — payment processing
• PayPal Holdings Inc. — payment processing
• Google LLC (Google Analytics 4, YouTube) — analytics and embedded media
• Brevo SAS (formerly Sendinblue) — newsletter and email communications
This list may be updated over time. The most current version will always be available on this page.
9. Your rights
Under Articles 15–22 GDPR, you have the right to:
• Access your personal data (Art. 15)
• Obtain rectification of inaccurate data (Art. 16)
• Request erasure of your data (Art. 17)
• Restrict processing (Art. 18)
• Receive your data in a structured, commonly used and machine-readable format (data portability, Art. 20)
• Object to processing (Art. 21)
• Withdraw consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal (Art. 7(3))
To exercise any of these rights, please contact:
You also have the right to lodge a complaint with the competent supervisory authority:
Italian Data Protection Authority (Garante per la protezione dei dati personali) — www.garanteprivacy.it
10. Children
The service may be used by minors only under adult supervision. In accordance with Article 8 GDPR and applicable Italian data protection law, ClueGo does not knowingly collect personal data from children under the age of 14 without the consent of a parent or legal guardian.
If ClueGo becomes aware that personal data has been collected from a child under 14 without the required consent, such data will be deleted immediately. Parents or guardians may request deletion by writing to info@cluegovisit.com.
11. Changes to this policy
This Privacy Policy may be updated to reflect regulatory or operational changes. In the event of material changes, registered users will be notified by email. The latest version will always be available on this page.
12. Last updated
August 2026