Privacy policy
1. Who we are
Iguazu Tickets (“we”, “us”, “our”) is an independent booking concierge service. We are the data controller for the personal information you provide to us in connection with booking tickets to Iguazú National Park.
You can contact us about privacy matters at [email protected].
Booking & payment data
When you click through to book, GetYourGuide collects and processes your booking and payment data as an independent data controller under its own privacy policy. We do not process payments and never see or store your card details. Our lawful basis for the limited data we handle — site analytics and, if you opt in, a visitor-guide email — is legitimate interest and your consent.
2. What we collect and why
We only collect the minimum information required to fulfil your booking and run the site.
2.2 Analytics and site-performance data
- Anonymised usage data: pages viewed, clicks, approximate geographic region (city-level only), device type, browser.
- Session recordings via Microsoft Clarity or ContentSquare (masked — we cannot see what you type in form fields).
- Google Analytics 4 with IP anonymisation enabled.
2.3 Support correspondence
When you email us, we keep the thread so we can help you properly. We do not share it with third parties.
4. Who we share your data with
We only share your data with the processors we need to operate the service:
| Processor | Purpose | Location |
|---|---|---|
| Google Workspace | Hosting our email (bookings inbox) | US / EU |
| Cloudflare, Inc. | Hosting the website, CDN, security | Global network |
| Cloudways (DigitalOcean) | Hosting the booking backend and order records | EU region |
| Google (Analytics 4) | Anonymised site analytics | US / EU |
| Microsoft Clarity / ContentSquare | Masked session replay | US / EU |
Each processor is bound by a data-processing agreement and (where applicable) the European Commission's Standard Contractual Clauses for transfers outside the EU/EEA. We never sell your data. We never share it for advertising purposes beyond our own Google / Meta conversion tracking.
5. International transfers
Your data may be transferred and processed in jurisdictions with data-protection regimes essentially equivalent to those in the EU/EEA. We rely on the European Commission's Standard Contractual Clauses (SCCs) for all transfers outside the EU/EEA.
6. How long we keep your data
- Booking records — 7 years, to meet applicable tax and record-keeping law.
- Support email threads — 2 years, then deleted.
- Analytics data — 26 months (GA4 default), anonymised throughout.
- Marketing consent — we will remove you from all non-transactional lists immediately on request.
7. Your rights
Regardless of where you are, you can ask us to:
- Access a copy of the data we hold on you.
- Correct data that is inaccurate.
- Delete your data (subject to legal-retention requirements above).
- Port your data to another provider in machine-readable form.
- Object to processing you disagree with.
- Withdraw any consent you previously gave.
To exercise any of these rights, email [email protected]. We respond within 30 days. If you're in the EU/EEA/UK and unhappy with our response, you can complain to your national data-protection authority.
8. Cookies
We use a small number of cookies. Strictly necessary cookies keep the site working (language preference, currency choice, checkout state). Analytics cookies help us improve the site (anonymised). Advertising cookies track conversions (set only if you consent). See our Cookie policy for the full list and to change your preferences.
9. Children
Our service is not directed at children under 16. If we discover that we have inadvertently collected personal information from a child under 16 without parental consent, we will delete it.
11. Changes to this policy
If we make a material change we will update the “last updated” date at the top, and email anyone affected. Minor clarifications will just get a date bump.