Privacy Policy

Effective date: 1 January 2026 · Last updated:

LAGAI Institute (“we”, “our”, “LAGAI”) respects your privacy. This policy explains what personal information we collect, why we collect it, how we use it, and the rights you have over it under the EU General Data Protection Regulation (GDPR) and the UK GDPR.

Who we are

LAGAI (Luso-Anglo-German-African Institute) is the controller of the personal data described in this policy. Our Cultural Research and Tourism Department operates the website you are currently visiting and the Welcome Experience programme based in Praia, Cape Verde.

Contact for data matters: info@laga-institute.org

What personal data we collect

1. When you submit the Welcome Experience booking form

Full name
Email address
Country of origin
Preferred arrival date and number of travellers
How you heard about us (optional)
Any notes you choose to share
Whether you have opted in to be asked about research participation
The IP address and browser user-agent of the submission (for fraud prevention)

2. When you submit the contact form

Full name
Email address
Subject and message content

3. When a Certificate of Cultural Participation is issued in your name

The name as it should appear on the certificate
Country of origin
Date the certificate is issued
A unique reference code (format LWE-YYMMDD-XXXX)

4. When you visit any page on this site

Standard server logs (IP address, browser type, pages viewed, referring URL, date and time)
Cookies set by our hosting provider and content delivery network for technical operation of the site (see Cookie Policy)

Why we collect it (legal basis under GDPR)

Purpose	Data used	Legal basis
To respond to your booking inquiry and arrange your visit	Booking form data	Steps prior to entering a contract (Art. 6(1)(b) GDPR)
To send you confirmation and status-update emails	Your email + reference code	Legitimate interests (Art. 6(1)(f)) and contract performance
To answer your contact form message	Contact form data	Legitimate interests (Art. 6(1)(f))
To issue and publicly verify your certificate	Name, country, date, reference	Contract performance (Art. 6(1)(b))
To invite you (in person, on campus) to participate in cultural research	The “open to being asked” checkbox	Your explicit consent (Art. 6(1)(a)) — given again, in person, before any data is collected
To keep the website online and secure	Server logs, technical cookies	Legitimate interests (Art. 6(1)(f))

We share the minimum necessary, only with:

Our hosting provider (Hostinger) — your data is stored on their servers as part of our website database
Our email service (Hostinger SMTP) — to deliver booking confirmations and status updates
Partner hotels and local guides — only the minimum needed to confirm your accommodation and pickup (your name, arrival date, group size). We do not share email addresses without your explicit consent.

We never sell your data, never share it for marketing by third parties, and never include identifiable visitor data in any published research without your explicit, separate, written consent.

Note that the public Certificate Verification page (/verify-certificate/{reference}/) displays the recipient’s name, country of origin, and issue date of any issued certificate. This is intentional — it is what makes the certificate verifiable. If you do not want your name on the public verification page, simply decline the certificate at the end of your visit.

How long we keep it

Booking inquiries: 3 years from submission, then deleted
Confirmed bookings: 7 years (for tax and accounting compliance)
Contact form messages: 2 years from last reply
Issued certificates: Indefinitely (so the public verification link continues to work). You can request removal at any time — see “Your rights” below.
Server logs: 90 days, then automatically purged

Your rights under GDPR

You have the right to:

Access the personal data we hold about you
Rectify data that is inaccurate or incomplete
Erase your data (“right to be forgotten”), subject to the retention requirements above
Restrict how we process your data
Object to processing based on legitimate interests
Data portability — receive your data in a machine-readable format
Withdraw consent at any time, where we rely on consent
Lodge a complaint with the data protection authority in your country (e.g. ICO in the UK, CNPD in Portugal, BfDI in Germany, FTC in the USA)

To exercise any of these rights, email info@laga-institute.org. We respond within 30 days, free of charge.

Cookies

See our separate Cookie Policy for the cookies this site sets and how to control them.

Contact & complaints

Questions about this policy, your data, or how to exercise your rights:

Email: info@laga-institute.org
Post: LAGAI Institute, Praia, Santiago Island, Cape Verde

We aim to resolve concerns directly. If we cannot, you have the right to contact your national supervisory authority (ICO, CNPD, BfDI, etc.).