Cookie Policy

A cookie is a small text file that a website stores in your browser or device when you visit it. When you return, that information allows your browser to be recognised and details about your visit to be remembered (for example, your language or your logged-in session).

Alongside cookies, we use other similar technologies with equivalent purposes, including:

• Web beacons and pixels: small images or snippets of code that help, for example, to tell whether you have opened a page or, where applicable, an email. On our website they are always first-party.
• Local storage (local storage / session storage): areas of the browser where we save information so the website works better or faster (for example, details of your search while you book).
• Device or session identifiers needed to keep your experience consistent.

Throughout this document we use the term cookies in a broad sense to refer to all of these technologies.

We use cookies for specific and proportionate purposes:

• Making the website work: keeping you logged in (remember that at travel care access is passwordless, by magic link or a code sent to your email), protecting the site against fraud and bots, and enabling essential steps such as searching, the booking process and payment.
• Remembering your preferences: your language (es, en, fr, de, it, pt, nl) and the currency in which you see prices, so you don't have to choose them on every visit.
• Measuring and improving (first-party measurement): understanding, in aggregate, which pages are visited and how the search tool performs. We produce this measurement ourselves, with no third-party tools and without sharing anything with anyone.
• Personalisation (only with your consent): remembering your latest searches so we can offer you shortcuts such as “Continue your search” and suggestions for the destination you are interested in.

Personalisation is only activated if you accept it. Technical cookies, preference cookies and our first-party measurement are always used, because without them we could not provide the service you request or keep the website secure and in good shape.

These are the four real categories you will see in our settings panel:

Technical (always active)

Essential for browsing, keeping your session, booking and paying securely. They include protection against fraud and bots and the cookie that stores your own cookie choice. They do not require your consent and cannot be disabled without breaking the website's basic functionality.

Preferences (always active)

They remember your language and your currency so you don't have to choose them on every visit. They simply keep decisions you have made yourself in order to provide the service exactly as you request it, so they form part of the service itself.

First-party audience measurement (exempt from consent)

Usage statistics produced by us alone: the information is processed in aggregate, is not shared with any third party, is not used for advertising and does not follow you across other websites. Because all of these conditions are met, this strictly first-party measurement is considered exempt from consent under the criteria of data protection authorities. Even so, we show it in the settings panel with full transparency.

Personalisation (only with your consent)

If you accept it, we remember your latest searches so we can offer you shortcuts such as “Continue your search” and suggestions for the destination you are interested in. You can switch it on or off whenever you wish; if you reject it, the website works exactly the same, just without those shortcuts.

The presence of third parties on our website is minimal and limited to security:

• Cloudflare Turnstile: an anti-bot verification loaded only when you sign in to your account and when you sign up to our newsletter, to prevent automated and fraudulent use of those forms.
• Cloudflare security cookies (such as __cf_bm or cf_clearance): these are set by the infrastructure that serves our website to protect it against bots and attacks.
• Payments (Redsys, Revolut): when you pay, we take you to the gateway's own secure page; there are no embedded gateway scripts or content on our website. Any cookies they use apply on their own sites, under their own policies.

We do not use Google Analytics or third-party advertising pixels. All of our measurement is first-party and no third party receives data about your browsing on travel care for analytics or advertising purposes.

This is the complete list of the cookies and browser storage we use, with their purpose, who sets them and how long they last:

Technical (always active)

• tc_refresh — keeps your user session securely signed in (passwordless access); first-party; around 60 days from your last use.
• tc_auth_bind — sign-in security: it ties the login link or code to the browser you requested it from; first-party; 10 minutes.
• tc_cmp — stores your own cookie choice (what you accept or reject in the settings panel); first-party; 12 months.
• Local storage of your user session — keeps your access token and basic profile data so you stay signed in while you use the site; first-party, in your browser; until you sign out.
• Search and booking session storage — keeps the details of the process in progress (dates, occupancy, passengers) while you search or book; first-party, in your browser; deleted when you close the tab.

Preferences (always active)

• NEXT_LOCALE — remembers your preferred language; first-party; 12 months.
• tc_currency — remembers the currency in which you see prices; first-party (browser local storage); until you change it or clear your browser data.

First-party audience measurement

• tc_vsid — visitor session for our own measurement and to link the bookings you make to you; first-party; 30 days from your last visit.

Security (Cloudflare)

• Cloudflare Turnstile — anti-bot verification, loaded only when you sign in to your account and when you sign up to the newsletter; third-party (Cloudflare); as per its own policy.
• __cf_bm and cf_clearance — protection of the website against bots and attacks, set by the infrastructure that serves it; Cloudflare; around 30 minutes / variable.

Personalisation does not set any additional cookie: if you accept it, we reuse the browsing data already described (associated with tc_vsid) to remember your latest searches. This list is exhaustive: you will not find any third-party analytics cookie or any advertising tracker on our website.

You are in control at all times, and withdrawing your consent is as easy as giving it. You can open the settings panel in three ways:

• From this very page: using the “Cookie settings” button you will find at the top of the page.
• From the page footer: the “Cookie settings” link is available on every page of the website.
• From your browser: most browsers let you view, block or delete cookies. Check your browser's help (Chrome, Firefox, Safari, Edge or others) to adjust these options.

In the panel you can accept everything, reject everything or enable only personalisation, and change your decision whenever you wish with immediate effect. Please bear in mind that blocking technical cookies from your browser may affect how the website works: for example, you could lose your session or your language and currency preferences.

The only category that requires your consent is personalisation, in accordance with article 22.2 of Law 34/2002 on Information Society Services and Electronic Commerce (LSSI), the General Data Protection Regulation (Regulation (EU) 2016/679, GDPR) and Organic Law 3/2018 (LOPDGDD). The legal basis for each category is as follows:

• Technical and preferences: the provision of the service you request from us. They are exempt from consent because they are essential for the website to work and to respect the options you choose yourself.
• First-party audience measurement: our legitimate interest in improving the website, covered by the exemption applicable to strictly first-party audience measurement (produced by us, aggregated, with no third parties, no advertising and no cross-site tracking).
• Personalisation: your consent, which you can grant, deny or withdraw at any time, as easily as you gave it, without this affecting the lawfulness of any processing carried out before its withdrawal.

Your choice is kept for 12 months. After that period, or if the version of this policy changes (for example, because we add a new cookie or a purpose changes), we will ask you again. You can withdraw your decision at any time from the “Cookie settings” link in the page footer or from the button on this very page. For more information about your rights, see our Privacy Policy.

We may update this Cookie Policy to reflect technical or regulatory changes, or changes in the tools we use. The version in force will always be the one available on this page, with its last-updated date.

If a change is significant, we will update the policy version and the settings panel will appear again so you can decide anew with up-to-date information. If you have any questions about the use of cookies, write to us at travel@travelcare.io.