Privacy policy
What personal data we collect, why, and how you stay in control.
Last updated: October 2026
1. Data controller
- Company: Citylife Group SL (trading as Sojourners Tours)
- Tax ID (CIF): B86970662
- Registered office: Calle Gran Vía 33, 8D, 28013 Madrid, Spain
- Email: [email protected]
- Phone: +34 663 933 654
- Commercial registry: Registro Mercantil de Madrid, Tomo 32.203, Folio 31, Hoja M-579573
- Travel agency licence: CICMA 3214 (Comunidad de Madrid)
For any question about your personal data, write to [email protected].
2. What data we collect
- Booking data: name, email, phone number and, depending on the trip, nationality, date of birth, university, dietary requirements and an emergency contact, for each traveler in the booking.
- Travel documents and flights: for trips that need them, the name as shown in the passport, passport number, issuing country and expiry date, date of birth, and your arrival and return flight details (date, time, flight number and airport). You add these in your traveler account after booking. Passport numbers are stored encrypted.
- Account data: email, name and the password you choose (stored encrypted).
- Payment data: payments are processed by our payment provider (Stripe). We never see or store your full card number; we only keep a reference to charge the installments you have agreed to.
- Messages: what you write to us in the dashboard chat, by email or in the request forms.
- Technical data: IP address, browser and cookies, as described in the Cookie Policy.
3. Why we use your data and legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Managing your booking, payments, itinerary and travel services | Performance of a contract (art. 6.1.b) |
| Answering your questions and tailor-made trip requests | Steps prior to a contract or your consent (art. 6.1.b and 6.1.a) |
| Invoicing, accounting and tax obligations | Legal obligation (art. 6.1.c) |
| Sending trip news and offers, only if you tick the box | Consent (art. 6.1.a), which you can withdraw at any time |
| Preventing fraud and keeping the website secure | Legitimate interest (art. 6.1.f) |
| Dietary requirements or other health-related information you choose to give us | Your explicit consent (art. 9.2.a), only to organise your trip |
4. Who receives your data
We share only what is needed with:
- Travel suppliers for your trip: accommodation, transport companies, local guides and activity providers.
- Service providers that work for us under a data processing agreement: website hosting (Host Europe), payment processing (Stripe Payments Europe, Ltd.), delivery of booking emails (Brevo), website security and performance (Cloudflare), email and office tools (Google Workspace) and cookie consent management (CookieYes).
- Public authorities when the law requires it.
Some of our trips take place outside the European Economic Area (for example Morocco). In those cases the data strictly necessary to provide the services you booked (such as traveler names, passport details and arrival times for accommodation, transport and local registration requirements) is sent to suppliers in the destination country. This transfer is necessary for the performance of your travel contract (art. 49.1.b GDPR).
5. How long we keep your data
- Booking and traveler details, including passport and flight details: for the duration of the trip and up to 24 months afterwards, after which they are anonymised.
- Invoices and accounting records: for the periods required by tax and commercial law (up to 6 years).
- Chat messages and requests: while your account is active or until you ask us to delete them.
- Marketing consent: until you withdraw it.
6. Your rights
You can ask us to access, correct, delete or port your data, to restrict or object to its processing, and to withdraw your consent at any time, by writing to [email protected] from the email linked to your account. We may ask you to prove your identity. You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es).
7. Minors
Our trips and this website are intended for people aged 18 or over. We do not knowingly collect data from minors.
8. Security
We apply technical and organisational measures to protect your data: encrypted connections (HTTPS), restricted staff access, encryption of passport numbers in our database, regular updates and security monitoring of the website.
9. Changes
We may update this policy to reflect legal or service changes. The current version is always available on this page.