Contacts

To process and manage your booking, including confirming and administering your reservation.  

This data is required to enter into and perform a contract with you. If you do not provide this information, we may not be able to confirm your booking or secure your place on a tour. 

Identification and contact details:  

Full name 

Email address and phone number 

Booking information: 

Selected tour, travel dates, number of participants, preferences 

Nationality and responses to booking-related questions 

Performance of a contract (Article 6(1)(b) GDPR) 

Customer identification and booking data: 5 years after completion of the booking 

Cancelled bookings (no payment): 6 months after cancellation 

To provide and manage your customer account, including giving you access to your booking history, saved preferences, wishlists, and other account features available through our customer portal. 

You are not required to create a customer account. However, without an account, certain self-service features and access to historical booking information may not be available. 

Identification and contact details:  

Full name 

Email address 

Account data: 

Login credentials and authentication information  

Account creation date and account status 

Customer account content: 

Booking history 

Saved preferences 

Wishlists and other information stored within the account 

Article 6(1)(f) GDPR – Legitimate interest: to provide customers with access to account-based features, booking history, saved preferences, and other self-service functionality. 

We retain account information for as long as your account remains active. 

If your account remains inactive for 5 consecutive years, we may notify you using the email address associated with your account and invite you to log in to keep your account active. If you do not reactivate your account within 30 days after our reminder, your account and the personal data associated with it will be permanently deleted, unless we are required to retain certain information for a longer period to comply with legal obligations or to establish, exercise, or defend legal claims. 

To organise and operate your tour, including planning logistics and coordinating with guides, transport providers, and other partners to deliver your experience.  

This data is required to provide the booked service. Without it, we may not be able to properly organise or carry out your tour. 

Identification and contact data: 

Full name 

Email address and phone number 

Booking and logistics data: 

Tour details, travel dates, number of participants 

Accommodation address (for pick-up and drop-off) 

Logistical requirements and preferences (e.g., timing, coordination needs) 

Performance of a contract (Article 6(1)(b) GDPR) 

Printed transport coordination data: deleted no later than 7 days after the tour 

Information that forms part of booking records: retained in line with booking data (5 years) 

To document and investigate accidents, injuries, or safety incidents during tours, including managing follow-up actions and handling potential legal claims.  

Providing this data may be necessary in the context of an incident and related legal or safety obligations. 

Identification and contact data: 

Full name 

Contact details (email, phone number) 

ID number (where required under local law) 

Incident-related data: 

Description of the incident, including date, time, and location 

Witness statements and staff reports 

Health-related data: 

Injury details and relevant medical information 

Treatment provided or required 

Legal obligation (Article 6(1)(c) GDPR) – where reporting or documentation is required

Legitimate interest (Article 6(1)(f) GDPR) – to investigate incidents and protect individuals and the Company

Article 9(2)(f) GDPR – for the establishment, exercise, or defence of legal claims (for health-related data) 

Incident and injury records (including reports and documentation) are retained for 10 years after the incident 

To communicate with you and provide customer support, including answering inquiries and handling feedback or complaints. 

You are not required to provide this data, but without it we may not be able to respond to your request or assist you effectively. 

Identification and contact data: 

Full name 

Email address and phone number 

Booking-related data (where applicable): 

Booking references and tour details linked to your request 

Communication data: 

Messages, inquiries, complaints, and feedback 

Communication history (email, social media, or phone) 

Customer-provided information: 

Travel preferences or other information you choose to share 

Performance of a contract (Article 6(1)(b) GDPR) – where communication relates to an existing booking or support request connected to our services. 

Legitimate interest (Article 6(1)(f) GDPR) – to respond to general inquiries, manage customer communication, and improve our services. 

General enquiries (no booking): 12 months after case closure 

Support related to bookings: 3 years after completion of the service 

Complaints or dispute-related communication: 5 years after resolution 

Health-related information shared in communication: deleted within 30 days after the tour unless required for an incident 

To process payments and manage financial transactions related to your booking, including payment verification and fraud prevention measures where necessary. 

This data is required to perform a contract with you and to help ensure secure payment processing. If you do not provide this information, we will not be able to process your payment or confirm your booking. 

Identification and contact data: 

Full name 

Email address and phone number 

Payment and transaction data: 

Payment amount, transaction identifiers, payment reference numbers 

Payment status and billing information (e.g., invoices, confirmations) 

Limited card-related data: 

Cardholder name and masked card details (e.g., last four digits) 

Fraud prevention and verification data (where required): 

identification documents or verification details (e.g., passport or ID information) 

card verification information 

supporting documentation provided in connection with suspected fraudulent transactions or payment verification requests 

Performance of a contract (Article 6(1)(b) GDPR)

We may also rely on legal obligation (Article 6(1)(c) GDPR) to comply with accounting and tax requirements, and legitimate interest (Article 6(1)(f) GDPR) for fraud prevention and transaction security 

Payment transaction and financial records are retained for 10 years in accordance with accounting and tax legislation 

Fraud prevention and payment verification records are generally retained for up to 3 years after the transaction, unless longer retention is required in connection with an ongoing investigation, dispute, or legal claim. 

To take and share photos or video from tours, including making them available to participants and, where agreed, using them for marketing purposes.  

You are not required to appear in photos or videos, and your consent will be requested where images or recordings are used for promotional purposes. 

Photographs, video recordings or other visual content of tour participants 

Legitimate interest (Article 6(1)(f) GDPR) – to provide images or recordings to participants

Consent (Article 6(1)(a) GDPR) – for use of images or recordings in marketing or promotional materials 

Photos and videos shared with participants: retained for 2 months after the tour 

Photos and videos used for marketing (with consent): 5 years from publication or until consent is withdrawn 

Direct marketing communications

(email newsletters)

To send you newsletters and travel-related updates (you can unsubscribe at any time)

Identification and contact data: 

Name and surname 

Email address 

Marketing data: 

Subscription status and preferences 

Engagement data (e.g., email opens, clicks) 

Technical data: 

IP address (where collected during subscription) 

Consent (Article 6(1)(a) GDPR) – where you subscribe to receive marketing communications. You can withdraw your consent at any time by unsubscribing. 

We may also send marketing communications to existing customers in relation to similar services where permitted under applicable laws implementing the ePrivacy Directive. In such cases, you will always have a clear opportunity to opt out both when your contact details are collected and in each communication we send. 

We keep your subscription data for as long as you remain subscribed to receive our newsletters. 

If you stop interacting with our emails, we will normally retain your data for 36 months from your last engagement. Before this period ends, we may contact you to check whether you would like to continue receiving updates. 

If you unsubscribe, we will remove your contact details from our mailing list without undue delay. 

We keep a limited record of your consent and unsubscribe request for 4 years, to demonstrate compliance with our legal obligations. 

To analyse how our website is used and improve performance, functionality, and marketing (you can manage your preferences through our cookie settings) 

Online identifiers: 

Cookie IDs and device identifiers 

IP address, browser type, device information 

Usage and behavioural data: 

Pages visited, session duration, interactions 

Preferences and navigation patterns 

Consent (Article 6(1)(a) GDPR) – for non-essential cookies and tracking technologies 

Cookies and similar technologies used on our website have different lifespans depending on their purpose. 

Some cookies are deleted automatically when you close your browser, while others remain on your device for a defined period to recognise your preferences or improve your experience on future visits. 

For more detailed information about the specific cookies we use, please see the Cookies section below. 

To maintain records of individuals who have opted out of marketing communications (this ensures we respect your preferences and do not contact you again) 

Contact data: 

Email address 

Preference data: 

Opt-out status and reason, date of opt-out 

Legal obligation (Article 6(1)(c) GDPR) – to ensure that individuals who have opted out of marketing communications are not contacted again, in accordance with applicable data protection and electronic communications laws 

Suppression list data is retained for as long as necessary to ensure we continue to respect your opt-out request. 

To manage relationships with our suppliers, service providers, and contractors, including coordinating services, managing contracts, and processing payments.  

This data is required to enter into and perform a business relationship. Without it, we may not be able to work with the supplier or deliver certain services. 

Identification and contact data: 

Full name, identification number (where applicable) 

Email address and phone number 

Professional and business data: 

Job title, company name, business contact details 

Contractual and financial data: 

Contract details, service descriptions, engagement terms 

Invoice data, payment details, bank account information, tax identification details 

Performance of a contract (Article 6(1)(b) GDPR) – where we work directly with individual contractors

Legitimate interest (Article 6(1)(f) GDPR) – to manage relationships with supplier organisations and their representatives

Legal obligation (Article 6(1)(c) GDPR) – to comply with accounting, tax, and recordkeeping requirements 

Supplier and contractual data: retained for 10 years after the end of the contractual relationship 

Financial and invoice data: retained for 10 years in line with accounting and tax requirements