GDPR-Compliant · Effective: 1 August 2026 · Last reviewed: July 2026 · Version 1.0
Tour Expert is committed to protecting your personal data in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679 — “GDPR”), the Polish Personal Data Protection Act of 10 May 2018, and the Polish Act of 21 February 2019 implementing GDPR. This Policy explains what data we collect, why we collect it, how we use it, and your rights.
Data Controller: Tour Expert · Sole trader (JDG) · NIP: PL6781182972 · os. Piastów 63J/57, 31-626 Kraków, Poland · info@tourexpert.co · tourexpert.co
Supervisory Authority: UODO (Urząd Ochrony Danych Osobowych) · Stawki 2, 00-193 Warszawa · uodo.gov.pl · +48 22 531 03 00 · You have the right to lodge a complaint with UODO at any time.
1. Data We Collect and Why
1.1 Booking and Contract Data
When you make a booking or enquiry, we collect: full name; email address; telephone number; nationality; number of participants (including ages where relevant); special requirements (dietary, medical, accessibility); payment details (processed by Stripe — we do not store full card numbers); and tour preferences.
Legal basis: Article 6(1)(b) GDPR — processing necessary for the performance of a contract or pre-contractual steps at your request.
1.2 Account Data
If you create an account on tourexpert.co, we collect: name, email address, password (hashed), and booking history. You may delete your account at any time via your account settings.
Legal basis: Article 6(1)(b) GDPR — contract performance; Article 6(1)(a) GDPR — consent for marketing preferences.
1.3 Communication Data
Emails, enquiry form submissions, and other correspondence you send us. We retain communication records for the duration of our relationship and for 3 years thereafter for dispute resolution purposes.
Legal basis: Article 6(1)(f) GDPR — legitimate interest in responding to enquiries and maintaining records.
1.4 Website Usage Data (Cookies)
With your consent, we use cookies and similar technologies to understand how visitors use our website. See our Cookie Policy at tourexpert.co/legal/cookie-policy/ for full details.
Legal basis: Article 6(1)(a) GDPR — consent. You may withdraw consent at any time via the cookie preference centre on our website.
1.5 Marketing Communications
With your explicit consent, we may send you information about our tours, offers, and travel news by email. You can unsubscribe at any time by clicking the unsubscribe link in any email or contacting us at info@tourexpert.co.
Legal basis: Article 6(1)(a) GDPR — consent.
2. Special Category Data
Some bookings require us to process special category data (Article 9 GDPR), specifically health information (dietary requirements, medical conditions, accessibility needs). We process this data solely to ensure your safety and comfort during our tours.
Legal basis: Article 9(2)(a) GDPR — explicit consent; Article 9(2)(c) GDPR — protection of vital interests.
3. How Long We Keep Your Data
| Data Type | Retention Period |
|---|---|
| Booking and payment records | 5 years from the date of the tour (Polish tax law obligation — Art. 86 Tax Ordinance) |
| Account data | Duration of account + 2 years after last activity |
| Enquiries / correspondence | 3 years from last contact |
| Health / special category data | Duration of the tour + 6 months |
| Marketing consent records | Until consent is withdrawn + 3 years |
| Cookie consent records | 1 year from the date of consent |
| Complaint records | 3 years from resolution |
4. Who We Share Your Data With
We share your personal data only where necessary:
- Stripe Inc. — payment processing (Stripe Privacy Policy at stripe.com/privacy). Stripe is our data processor under a written DPA.
- WP Travel Engine / WordPress — booking management software hosted on our server. No personal data is shared with the software provider.
- Accommodation providers, transport suppliers, and local guides — where necessary to fulfil your booked tour. Data shared is limited to what is strictly necessary (typically name, contact, and any accessibility or dietary requirements).
- GetYourGuide / Viator — where your booking originated from these platforms, they share data with us as described in their respective privacy policies. We use this data solely to fulfil your booking.
- UODO or other competent authorities — where required by law or court order.
We do not sell, rent, or share your personal data with third parties for their own marketing purposes.
5. International Transfers
Some of our service providers (including Stripe) may process data outside the EEA. All such transfers are subject to appropriate safeguards, including EU Standard Contractual Clauses (SCCs) under Article 46 GDPR. Details are available on request.
6. Your Rights Under GDPR
You have the following rights, exercisable by contacting info@tourexpert.co. We will respond within 30 days (extendable to 3 months for complex requests):
- Right of access (Art. 15): Obtain a copy of your personal data we hold.
- Right to rectification (Art. 16): Correct inaccurate or incomplete data.
- Right to erasure (Art. 17): Request deletion of your data where no legal basis exists for continued processing.
- Right to restriction (Art. 18): Request that processing be restricted in certain circumstances.
- Right to data portability (Art. 20): Receive your data in a machine-readable format.
- Right to object (Art. 21): Object to processing based on legitimate interest or direct marketing at any time.
- Right to withdraw consent (Art. 7(3)): Withdraw any consent at any time without affecting prior processing.
- Right to lodge a complaint: With UODO at uodo.gov.pl or any EU supervisory authority.
We will never charge a fee for exercising your rights unless your request is manifestly unfounded or excessive.
7. Security
We implement appropriate technical and organisational security measures including: HTTPS encryption (TLS 1.2+) on tourexpert.co; password hashing for all account credentials; restricted access to personal data on a need-to-know basis; and regular security assessments. In the event of a personal data breach likely to result in a risk to your rights, we will notify UODO within 72 hours and you without undue delay, as required by Article 33–34 GDPR.
8. Changes to This Policy
We will publish any material changes to this Privacy Policy on this page and update the “Last reviewed” date. Where changes are significant, we will notify registered account holders by email. Continued use of our website after changes take effect constitutes acceptance of the revised Policy.
9. Contact
Data Controller: Tour Expert · NIP: PL6781182972 · info@tourexpert.co · os. Piastów 63J/57, 31-626 Kraków, Poland