Data processing terms

Subject matter and duration: providing the Tourtify service to you, for as long as you have an account, plus the deletion period below.

Data subjects: your travellers, enquirers, reviewers, travel agents and partners, and your team members.

Types of data: names and contact details; booking, payment and refund records (not card numbers); the traveller details your forms ask for, which may include passport, date of birth, dietary, medical or emergency-contact details; signed waivers; reviews; messages; and technical data such as IP addresses.

Purpose: hosting your booking website, taking and managing bookings, sending emails and notifications, and the other features you switch on.

We process this data only on your documented instructions, which are these terms, your settings in the console and the features and plugins you switch on, unless the law requires otherwise; if so, we will tell you first where the law allows. If we believe an instruction breaks data protection law, we will tell you.

You are responsible for having a lawful basis for the data you collect, for the notices you give travellers, for what your forms ask for, and for the services you connect with your own accounts (such as payment gateways, email marketing, WhatsApp or SMS providers and analytics tools).

Everyone at Tourtify who can access your data is bound by confidentiality and has access only where their work needs it.

We protect your data with measures suited to the risk, including encryption in transit, database-level separation between businesses, role-based access for your team, two-step sign-in, and a record of important changes. Our security page describes them.

You authorise us to use the sub-processors listed in our privacy policy. We impose data protection obligations on each of them that are no less protective than these terms, and we remain responsible for them. We will update that list before adding or replacing a sub-processor, and you may object on reasonable grounds; if we cannot address your objection, you may cancel your account.

You can find, correct and export traveller data from your console. To delete a traveller's data, or where you need more help to answer a request or to complete a data protection impact assessment, contact us and we will help where we reasonably can.

If we become aware of a breach affecting your data, we will tell you without undue delay, with the information we have about what happened and what we are doing about it, so you can meet your own obligations.

Some sub-processors process data outside your country, including in the United States. Where data protection law requires safeguards for these transfers, such as standard contractual clauses, we rely on them.

You can export your bookings at any time while your account is open. After your account is closed, we delete or anonymise your data after a limited period, except where the law requires us to keep it.

We will make available the information reasonably needed to show that we meet these terms, and answer reasonable questions about our processing. Contact hello@tourtify.com.