Privacy Policy

Lucky Earth ("we", "us", "our") is committed to protecting the privacy of everyone who uses our website, Travel Risk Map, and mobile application. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and what rights you have under the General Data Protection Regulation (GDPR) and applicable Irish law.

Please read this policy carefully. By using our services, you acknowledge that you have read and understood this policy.

1. Who We Are (Data Controller)

Lucky Earth acts as the Data Controller for personal data collected through luckyearth.org, luckyearth.org/map/, and app.luckyearth.org.

2. What Data We Collect

2.1 Data you provide directly

• Account registration: name, email address, password (hashed)
• Sponsor profile: business name, contact details, prize/reward description
• Contact form submissions: name, email, message content
• In-app communications: messages in community chat, event posts
• User-generated content: photos uploaded for challenges, quiz answers, safety alert reports

2.2 Data collected automatically

• Device and technical data: IP address, browser type and version, operating system, device identifiers
• Usage data: pages visited, time spent, features used, map interactions (filters applied, destinations viewed)
• Log data: server logs, error reports, timestamps
• Cookies and similar technologies: see our Cookie Notice for full details

2.3 Location data

If you use the Travel Risk Map or mobile app features that require location (e.g., finding nearby events or relevant risk alerts), we may process your approximate or precise location depending on your device settings and permissions. You can withdraw location permission at any time through your device settings.

2.4 Data from third parties

• Google Sign-In: if you authenticate via Google, we receive your name, email, and profile picture from Google
• Analytics providers: aggregated behavioural data about how users interact with our services
• Map providers: technical data associated with map tile loading and interactions

3. Legal Basis for Processing (GDPR Article 6)

4. How We Use Your Data

• To create and manage your account
• To provide the Travel Risk Map, quests, prize wheel, and community features
• To process sponsor registrations and verify prize redemptions via QR code
• To send transactional emails (account confirmation, password reset)
• To display community safety alerts on the map
• To improve our services through usage analytics
• To respond to your enquiries and provide customer support
• To detect and prevent fraud, abuse, or security incidents
• To comply with applicable legal obligations

5. Cookies and Tracking Technologies

We use cookies and similar technologies on our website and Travel Risk Map. These are categorised as Essential, Analytics, Functional, and Third-party cookies. Non-essential cookies are only placed after your explicit consent via our Cookie Banner. You can manage or withdraw your consent at any time by clicking "Cookie Settings" in the footer. Full details are available in our Cookie Notice.

6. Sharing Your Data

We do not sell your personal data. We may share your data with:

6.1 Service providers (Data Processors under GDPR Article 28)

• Cloud hosting provider (servers and infrastructure)
• Analytics provider (e.g. Google Analytics) — subject to your cookie consent
• Map provider (e.g. Google Maps, Mapbox) — receives technical request data
• Email delivery service — for transactional emails
• App stores (Google Play, Apple App Store) — for app distribution

All processors are engaged under Data Processing Agreements and are required to process your data only on our instructions.

6.2 Affiliate and travel partners

If you redeem a prize from a sponsor, the sponsor will receive confirmation of your prize win (verified via QR code scan). They do not receive your full account data. Affiliate booking partners linked from the app or map may set their own cookies and process data independently — please review their privacy policies.

6.3 Legal requirements

We may disclose your data if required by law, court order, or to protect the rights and safety of Lucky Earth and its users.

7. International Data Transfers

Lucky Earth is based in Ireland (EEA). Some of our service providers may process data outside the EEA (e.g. Google services in the United States). Where this occurs, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission and adequacy decisions where applicable. You may request details of the specific safeguards in place by contacting us at support@luckyearth.org.

8. Data Retention

9. Your Rights Under GDPR

As a data subject under GDPR, you have the following rights:

• Right of access (Art. 15): request a copy of the personal data we hold about you
• Right to rectification (Art. 16): request correction of inaccurate data
• Right to erasure (Art. 17): request deletion of your data ('right to be forgotten')
• Right to restriction (Art. 18): request that we limit processing of your data
• Right to data portability (Art. 20): receive your data in a machine-readable format
• Right to object (Art. 21): object to processing based on legitimate interests
• Right to withdraw consent (Art. 7(3)): withdraw consent at any time — this does not affect prior lawful processing
• Right not to be subject to automated decision-making (Art. 22): we do not engage in solely automated decisions with legal effects

To exercise any of these rights, contact us at: support@luckyearth.org

We will respond within 30 days. You also have the right to lodge a complaint with the Irish Data Protection Commission (DPC) at www.dataprotection.ie.

10. Children's Privacy

Lucky Earth is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us at support@luckyearth.org and we will delete it promptly.

11. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include encrypted data transmission (HTTPS/TLS), hashed password storage, and access controls. However, no system is completely secure and we cannot guarantee absolute security.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Significant changes will be communicated via a notice on our website or by email to registered users. The 'Last updated' date at the top of this page will always reflect the most recent version.

13. Contact Us