Privacy Policy

1.1 Personal information you provide

• Account Information: Name, email address, phone number, password
• Booking Details: Travel dates, destinations, number of travelers
• Traveler Information: Names and nationality where relevant to your booking
• Payment Information: Card details are entered directly with Stripe and are never collected or stored on our systems; we receive only the transaction outcome (status, amount, and payment reference)
• Special Requests: Dietary arrangements or other preferences you choose to share when making a booking — provided voluntarily and used solely to arrange appropriate accommodations
• Communication: Messages, reviews, feedback, support requests

1.2 Information we collect automatically

• Device Information: IP address, browser type, operating system, device identifiers
• Location Data: General location based on IP address (not precise GPS)
• Cookies & Tracking: Analytics data, preferences, session information (where consented)

1.3 Third-party information

• Social Login: Basic profile information from Google OAuth
• Payment Processors: Transaction status and payment verification
• Tour Partners: Booking confirmations and service updates

2.1 Service provision (legal basis: contract)

• Process and manage your tour bookings
• Coordinate with tour operators and accommodation providers
• Handle payments and refunds
• Provide customer support and assistance
• Send booking confirmations and travel information

2.2 Platform improvement (legal basis: legitimate interest)

• Analyze usage patterns to improve user experience
• Develop new features and services
• Ensure platform security and prevent fraud
• Conduct research and analytics

2.3 Marketing communications (legal basis: consent)

• Send promotional emails about new destinations and offers
• Share travel tips and destination guides
• Notify you about special deals and discounts
• Conduct surveys and collect feedback

You can opt out of marketing communications at any time using the unsubscribe link in emails or by updating your preferences in your account settings.

2.4 Legal compliance (legal basis: legal obligation)

• Comply with applicable laws and regulations
• Respond to valid legal requests and court orders
• Prevent fraud and ensure platform security
• Maintain records for accounting and tax purposes

3.1 Service providers and business partners

We share personal information only with third parties who assist in delivering our services, under strict data processing agreements.

• Tour Operators: Booking details necessary to fulfill your travel arrangements
• Payment Processors (Stripe): Your card details are collected directly by Stripe; we pass Stripe only the booking amount and reference needed to process the transaction
• Analytics Providers: Aggregated usage data where you have consented to analytics cookies
• Cloud Infrastructure: Hosting and storage providers under data processing agreements
• Communication Services: Email providers used to deliver booking confirmations and support
• Live Chat (Crisp): Messages and contact details you share when using our support chat
• Maps (Mapbox): Your IP address is visible to Mapbox when interactive maps load on our platform

We do not sell your personal data to third parties, data brokers, or advertisers.

3.2 Legal and regulatory disclosure

We may disclose personal information when required by law or to protect our legitimate interests:

• In response to valid legal process (court orders, subpoenas, regulatory requests)
• To comply with applicable Australian and international law
• To protect the rights, property, or safety of Tourify, our users, or the public
• In connection with fraud investigation or prevention

Where legally permitted, we will notify you of such disclosures.

3.3 Business transfers

In the event of a merger, acquisition, or asset sale, your personal information may be transferred as part of that transaction. We will:

• Notify you prior to your data being transferred and becoming subject to a different privacy policy
• Ensure the acquiring party maintains equivalent privacy protections
• Honor existing consent and opt-out preferences where technically feasible

4.1 Security measures

• Encryption: TLS/SSL encryption for all data in transit
• Access Controls: Role-based access limited to authorised personnel
• Third-Party Standards: Service providers are required to maintain equivalent security standards
• Regular Reviews: Periodic security assessments of our systems and processes
• Incident Response: Documented procedures for identifying and responding to security events

4.2 Security incident notification

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify relevant supervisory authorities within 72 hours where required by law
• Inform affected individuals without undue delay where there is a high risk to their rights
• Take prompt remediation steps to contain and address the incident

While we take all reasonable precautions, no method of electronic transmission or storage is 100% secure. We encourage you to use strong passwords and keep your account credentials confidential.

5.1 Right of access

You may request a copy of the personal information we hold about you. We will respond within 30 days. In complex cases or where multiple requests are received, we may extend this period by a further 60 days with notice.

5.2 Right to rectification

You may request correction of inaccurate or incomplete personal data. Many details can be updated directly via your account settings.

5.3 Right to erasure

You may request deletion of your personal data where it is no longer necessary for the purpose it was collected, you withdraw consent, or processing is unlawful. Exceptions apply where retention is required to comply with legal obligations (e.g. financial records) or to establish, exercise, or defend legal claims.

5.4 Right to data portability

Where processing is based on consent or contract and carried out by automated means, you may request your data in a structured, commonly used, machine-readable format.

5.5 Right to object and restrict processing

You may object to processing based on legitimate interests or for direct marketing purposes at any time. You may also request restriction of processing in certain circumstances.

5.6 How to exercise your rights

Submit a request to privacy@thetourify.com. We will respond within 30 days. Identity verification may be required to protect your data from unauthorised requests. If you are unsatisfied with our response, you have the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC), or with your local data protection authority if you are located in the EU or UK.

6.1 Google Analytics 4 & advertising tracking

With your consent, we use Google Analytics 4 and Google Tag Manager to collect information about your interactions with our platform. This data helps us improve our services and deliver relevant advertising.