This Privacy policy explains what personal data Excursa collects, why, and what rights you have. The data controller is [Company legal name], [registered address] (“Excursa”, “we”). Contact: hello@excursa.co.
What data we collect
- Account data: name, email, phone number, password (stored in encrypted form), language, profile photo if you add one.
- Booking data: tours you book, dates, number of people, comments, messages with Guides, reviews and ratings.
- Guide data: for Guides also city, languages, description, photos, tax status and tax ID, and payout details when payouts are available.
- Payment data: when online payment is available, payments are processed by our payment provider. We receive the payment status and the last digits of the card, not the full card number.
- Technical data: IP address, browser and device type, pages visited, and data stored in cookies and similar technologies.
- Messages to us: what you write in the contact form or by email.
Why we use your data
| Purpose | Legal basis |
|---|---|
| Creating your account, handling bookings, sending booking emails, letting you talk to the Guide | Performance of a contract |
| Payments, refunds, accounting and tax obligations | Legal obligation, performance of a contract |
| Preventing fraud and abuse, keeping the Platform secure | Legitimate interest |
| Improving the Platform, statistics of tour page views | Legitimate interest |
| Newsletter with new tours and offers | Consent (you can unsubscribe at any time) |
| Answering your messages | Legitimate interest, performance of a contract |
Who we share data with
- Guides: when you book a tour, the Guide sees your name, the booking details and your messages. Once the deposit is paid, the Guide also receives your contact details so you can meet.
- Service providers: hosting, email delivery, payment processing and analytics providers that process data on our behalf under contract.
- Authorities: when required by law or to protect rights and safety.
We do not sell your personal data.
International transfers
Travelers, Guides and our service providers are located in different countries. When data is transferred abroad, we use appropriate safeguards required by applicable law, such as standard contractual clauses.
How long we keep data
- Account data: while your account is active and up to 3 years after the last activity.
- Booking and payment records: as long as required by accounting and tax law, usually 5–7 years.
- Reviews: while the tour is on the Platform; they may be anonymised if you delete your account.
- Technical logs: up to 12 months.
Cookies
We use necessary cookies to keep you logged in and make the site work, and, where allowed, cookies to understand how the site is used. Your browser also stores small pieces of data on your device, such as recently viewed tours. You can delete cookies in your browser settings; some features may then stop working.
Your rights
Depending on the law that applies to you, you have the right to access your data, correct it, delete it, restrict or object to its processing, receive it in a portable format and withdraw consent. You can change most data in your account settings. For other requests write to hello@excursa.co; we answer within 30 days. You can also complain to your local data protection authority.
Security
We use encryption (HTTPS), access controls and other measures to protect your data. No system is completely secure, so please use a strong, unique password and tell us right away if you think your account has been accessed by someone else.
Children
The Platform is not intended for children under 18. We do not knowingly collect data from children; minors take part in tours only through a booking made by an adult.
Changes to this policy
We may update this policy. The current version is always on this page with the date of the last update; significant changes will be announced by email or on the Platform.