TheOneToGo
Privacy Policy
Who we are
TheOneToGo helps travelers discover experiences and book them through partner sites. TheOneToGo is operated as an independent business based in the Netherlands. For anything in this policy, including access or deletion requests, email hello@theonetogo.com. The business trading as theonetogo.com is the data controller for the personal data described below.
What we collect, and why
You can browse TheOneToGo and book an experience without giving us any personal data. You do not need an account, we never ask you to sign in, and the things we remember for you, like your saved favorites and recently viewed experiences, stay in your own browser and never reach our servers. When you decide to book, we hand you off to an external booking provider who takes your details and payment under their own privacy policy, not ours. We do not see or store any of that.
Apart from the analytics described below, which run only if you accept them, the only personal data we hold is what you choose to give us directly: your email if you sign up for our dispatch, or your name and message if you contact us. If you do none of these, we hold nothing that identifies you, so there is nothing for us to delete. We do not sell your data, we do not build an advertising profile of you, and we do not track you across other sites. The sections below cover each case.
Analytics and cookies
We use Google Analytics 4 to understand how the site is used. Analytics and advertising cookies are set only after you accept them in our consent banner. Until then they stay denied (Google Consent Mode v2), and we may receive aggregate, cookieless measurement. The legal basis is your consent. You can change your choice any time by clearing the site's storage in your browser, which resets the banner. We do not use these cookies to identify you personally.
Email sign-ups
If you subscribe to TheOneToGo dispatch, we collect your email address and the page or place you signed up from, and we pass these to MailerLite, our email service provider, who stores and processes them on our behalf to run the newsletter. We use double opt-in: after you sign up, MailerLite emails you a confirmation link, and you are only added to the list once you click it. The legal basis is your consent. We do not send your IP address with the sign-up. We keep your details until you unsubscribe or ask us to remove them. Every email includes a one-click unsubscribe, and you can email hello@theonetogo.com any time to unsubscribe or have your data deleted. MailerLite may process this data outside the European Economic Area under appropriate safeguards (see their privacy policy and data processing terms).
Contact form
If you message us through the contact form, we use the name, email, and message you provide to reply and to handle your request. Those messages are delivered to us by email (through Cloudflare Email Routing), not stored in a database, and we keep them only as long as we need to deal with what you raised and for our own records, then delete them. The legal basis is your consent and our legitimate interest in answering you. You can also just email hello@theonetogo.com directly.
Spam protection
Our forms are protected by Cloudflare Turnstile, which checks that a submission comes from a person rather than a bot. For that check, Cloudflare processes data such as your IP address and how you interact with the page, under its own privacy policy. We also briefly rate-limit submissions using a one-way hash of your IP address, which is then discarded. The legal basis is our legitimate interest in keeping the site free of abuse.
Hosting and infrastructure
The site is served by Cloudflare. As our hosting provider, Cloudflare processes technical data such as your IP address and request details to deliver pages and protect against attacks, acting as our processor under its own terms. To show prices in your local currency we also infer your approximate country from your network connection at the moment of the request. We do not store that and it does not identify you.
Affiliate links and partners
When you click a partner link (for example "Check availability") or interact with an embedded partner widget, such as a GetYourGuide availability widget, you connect to a booking partner (currently Viator, Tiqets, GetYourGuide, or Headout). The partner may set a cookie so it can attribute a booking and pay us a commission, at no extra cost to you. See our affiliate disclosure. Those partners, and Google, have their own privacy policies that govern the data they collect once their widgets load or once you are on their site.
Images
Some destination and hero photos are served directly by Unsplash. When those images load, your IP address and request details are visible to Unsplash, governed by their own privacy policy.
Stored in your browser, not by us
Your saved favorites ("My list"), your recently viewed experiences, and your cookie choice are kept only in your own browser (local storage). They stay on your device, are never sent to us, and you can clear them at any time by clearing the site's storage. We also use your approximate country (from your connection) to show prices in your local currency; this does not build a profile of you, and your viewing history is not sent to us.
International transfers
Some of the providers above, including Google, Cloudflare, Unsplash, and Viator, are based in the United States and may process data outside the European Economic Area. Where that happens, the transfer relies on a safeguard recognised under the GDPR: the EU-US Data Privacy Framework where the provider is certified, or otherwise the European Commission's standard contractual clauses.
Your rights
If the GDPR applies to you, you can ask us to access, correct, delete, or restrict your personal data, object to processing, receive a copy in a portable format, and withdraw any consent you gave (without affecting what we did before). To exercise any of these, email hello@theonetogo.com. You also have the right to complain to a supervisory authority. Ours is the Dutch Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
Children
TheOneToGo is meant for adults and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has sent us data, contact us and we will delete it.
Changes to this policy
We may update this policy as the site changes. When we do, we will revise the date at the top. Material changes will be made clear on this page.