The short version
- We collect only what we need to take your booking and pass it to the operator who runs your tour.
- Card payments are handled by Stripe. We never see or store your full card number.
- We do not sell your data and do not use advertising or tracking cookies.
- You can ask to see, correct or delete your data at any time.
1. Who is responsible for your data
The data controller is [BookToursGozo Ltd], company number [C 00000], [registered address, Malta]. For anything about your personal data, email [privacy@booktoursgozo.com].
The operator who runs your tour is a separate controller for the booking details we pass to them, and is responsible for how they use them.
2. Data about clients
| What we collect | Why | Legal basis |
|---|---|---|
| Name, email, mobile number | To confirm your booking, send the meeting point and contact you about changes or cancellations | Performing our contract with you |
| Tour, date, number of people, notes you add (for example medical or access needs) | To reserve your place and tell the operator what they need to know | Contract; for health information, your explicit consent |
| Payment confirmation and the last four digits of your card (from Stripe) | To take and refund deposits and keep accounting records | Contract and legal obligation |
| Messages and complaints | To help you and improve our service | Contract and our legitimate interest |
| Email address for news and offers | Only if you sign up | Your consent, which you can withdraw at any time |
3. Data about operators
When a business registers, we collect the account holder's name, email, phone number and a protected (hashed) password, the company's details, its registration, licence and insurance documents, and the tours it creates.
We use this to check that operators are legitimate and licensed, to run the operator dashboard, to publish approved tours, and to contact the operator about bookings. The legal bases are performing our contract with the operator, our legitimate interest in keeping the platform safe for clients, and legal obligations.
4. Data from the website
- Your browser stores your language choice and, if you use an operator or admin account, that you are signed in. See our cookie policy.
- Our hosting provider keeps short-lived server logs, including IP addresses, to keep the site secure and working.
- The website loads fonts from Google Fonts and an animation library from cdnjs (Cloudflare). Your browser connects to those services, which see your IP address.
5. Who we share it with
- The operator of your tour: lead client name, number of people, contact number, notes and the balance to collect. Nothing more.
- Stripe, to process deposits and refunds.
- Service providers who host the website, send our emails and store our data, under contracts that only let them use it on our instructions. [List providers before launch]
- Professional advisers and authorities, such as our accountants, or the police and tax authorities where the law requires it.
We never sell personal data.
6. Transfers outside the EU
Some of our providers may process data outside the European Economic Area. When they do, we make sure it is protected by an adequacy decision of the European Commission or by the Commission's standard contractual clauses.
7. How long we keep it
- Booking and payment records: for as long as Maltese tax and accounting law requires, [currently up to 10 years].
- Messages and complaints: up to 2 years after we close them.
- Operator accounts and documents: while the account is open, then up to [6 years] in case of claims.
- Marketing emails: until you unsubscribe.
8. Your rights
Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to you or another service in a common format. Where we rely on your consent, you can withdraw it at any time.
Email [privacy@booktoursgozo.com] and we will reply within one month. If you are not satisfied, you can complain to the Information and Data Protection Commissioner (IDPC) in Malta, or to the data protection authority where you live.
9. Security
We use encrypted connections, restrict access to people who need it, store passwords only in protected form and leave card handling to Stripe. No system is perfectly secure; if a breach puts your data at risk, we will tell you and the authorities as the law requires.
The website is not aimed at children. Bookings must be made by an adult.
10. Changes and contact
We will update this policy when how we use data changes, and tell you by email about important changes. Contact: [privacy@booktoursgozo.com], [registered address, Malta].
Last updated: [date]