Privacy Policy

This policy explains what personal data Three Suitcases (“we”, “us”) collects when you visit threesuitcases.com, why we collect it, and what your rights are. We are the data controller for the purposes of UK GDPR and the Data Protection Act 2018.

1. Who we are

Three Suitcases is an independent family travel blog published from the United Kingdom. You can reach us at hello@threesuitcases.com.

2. What we collect

We keep the data we collect to a minimum. Specifically:

• Newsletter signups. If you subscribe, we store your email address, consent date, signup source and consent wording version in our database. When email delivery is enabled, we also send your address and subscription status to Resend, our email delivery processor, so it can deliver and suppress trip-update emails.
• Messages. If you email us, your email provider and ours process the address and message so we can reply. The website does not currently operate a separate contact-form database.
• Analytics. If you consent to analytics, we use Google Analytics 4 to understand how pages are used. GA4 collects pseudonymous identifiers, page views, approximate location (country / region, not street address), device and browser type, and referring URL. We do not link this data to any account.
• Affiliate and partner link clicks. When you click a link to a partner site, we log the page path, timestamp, and referring host so we can measure which recommendations are useful. We do not store an IP address or user agent with the click.
• Helpfulness votes and feedback. If you mark a page as helpful or not, we store that vote anonymously.
• Server logs. Our hosting provider (Cloudflare) records standard request logs (IP address, timestamp, path) for security and performance. These are retained per Cloudflare's own policies.

3. Legal basis

We rely on the following UK GDPR legal bases:

• Consent for analytics cookies and newsletter signups. You can withdraw consent at any time.
• Legitimate interests for essential site security (logs, bot protection), anonymous affiliate click measurement, and retaining a minimal suppression record so we honour an unsubscribe request, balanced against your rights.
• Legitimate interests when we read and respond to ordinary reader correspondence, and contract / pre-contract when you ask us to take steps relating to a partnership or licensing agreement.

4. Cookies

We use as few cookies as possible. A cookie banner on your first visit lets you accept or decline analytics cookies. You can change your choice at any time by clearing the banner decision in your browser storage.

• Essential cookies: used for preview access (if set), theme preference, and to remember your cookie choice. These cannot be disabled.
• Analytics cookies (Google Analytics 4): only loaded after you accept. Provided by Google LLC; see Google's privacy policy.

5. Affiliate links

Some outbound links on the site are affiliate links or clearly labelled commercial partner links. If you click one and complete a qualifying booking or purchase, we may earn a commission. We do not add a fee to your booking. Clicking these links may set cookies on the partner's domain; that data is governed by their privacy policies, not ours. See our Affiliate Disclosure for details of how we handle commercial relationships.

6. Sharing your data

We do not sell personal data. We share data only with:

• Our infrastructure providers (Cloudflare for hosting and CDN).
• Resend, when newsletter delivery is enabled, as our email delivery and contact-list processor. See Resend's privacy policy.
• Google, if you consent to analytics.
• Commercial partners, only in aggregate campaign reports that do not identify you personally.
• Law enforcement if required by a valid legal request.

7. International transfers

Cloudflare, Google and Resend may process data outside the UK and EEA. Where required, we use the providers' contractual transfer safeguards and data-processing terms.

8. Retention

• Newsletter: an active consent record is kept while you remain subscribed. After you unsubscribe, a minimal email and status record may be retained as a suppression record for as long as needed to honour your choice, unless you ask us to delete it.
• Contact messages: kept for up to 2 years, then deleted.
• Analytics: default GA4 retention (14 months).
• Affiliate click logs: aggregated and kept for up to 24 months.

9. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Ask us to correct or delete it.
• Object to processing or withdraw consent.
• Request a copy in a portable format.
• Complain to the Information Commissioner's Office (ico.org.uk).

To exercise any of these rights, email hello@threesuitcases.com. We will respond within 30 days.

10. Children

This site and its newsletter are aimed at adult travellers. We do not knowingly collect newsletter or correspondence data directly from children under 13.

11. Changes to this policy

We may update this policy. If the change is material we will announce it on the homepage and update the “last updated” date above. Your continued use of the site after a change indicates acceptance.

12. Contact

Questions about this policy: hello@threesuitcases.com.