1. Introduction
Getutu Adventures (“we”, “us”, “our”) is committed to protecting the privacy of all visitors and customers of https://www.getutuadventures.com (“Website”). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you interact with our services—whether from the EU, UK, or the US.
2. Scope & Applicability
- GDPR (EU) and UK GDPR apply when we offer services to, or monitor the behavior of, individuals located in the EU or UK.
- U.S. laws: We comply at minimum with CalOPPA requiring conspicuous posting of a privacy policy for Californians, and follow FTC fair information practices — emphasizing notice, choice, access, security, enforcement.
- Where applicable, we also observe CCPA/CPRA rights for California residents, plus any relevant emerging state privacy laws.
3. Information We Collect
- Personal Data (identifiable information): Name, contact details, booking info, payment details, travel preferences.
- Technical Data: IP address, browser type, device, cookies and usage data.
- Marketing Data: Preferences and opt-in status for communications.
4. How We Use Your Data
We process personal data under these lawful bases:
EU/UK GDPR
- Consent: You explicitly agree, e.g., subscribing to marketing.
- Contract performance: Managing bookings and customer service.
- Legal obligation: Handling regulatory or financial requirements.
- Legitimate interest: Improving services (balanced against your rights).
U.S. / FTC Principles:
- Notifying you about data practices.
- Allowing opt-out of marketing.
- Keeping data accurate and secure.
Specific Uses:
- Manage your bookings and tour arrangements.
- Provide customer support.
- Improve user experience through analytics (with consent where required).
- Send promotional content if you opt in; always include opt-out options.
5. Cookies & Tracking
We use cookies and similar technologies for:
- Essential Website operations.
- Preferences and functional enhancements.
- Analytics and marketing (only with your consent in the EU/UK).
You may control cookies via browser settings or our cookie banner, in compliance with the ePrivacy Directive.
6. Sharing & Data Transfers
We may share data with:
- Third-party providers (e.g., payment processors) under confidentiality agreements.
- Authorities, when legally obligated.
If transferring data outside the EU/UK:
- We’ll rely on adequacy decisions, standard contractual clauses, or frameworks like the EU–US Data Privacy Framework.
7. Data Retention
We retain personal data only as long as necessary to fulfill service obligations, comply with law, or to resolve disputes. Retention duration aligns with GDPR principles of storage limitation.
8. Your Privacy Rights
Under GDPR / UK GDPR:
- Access your personal data.
- Rectify inaccurate data.
- Request erasure (“right to be forgotten”).
- Restrict or object to processing.
- Data portability.
- Withdraw consent at any time.
- Lodge a complaint with a supervisory authority.
Under U.S. Laws:
- California residents may request data disclosure or deletion, and opt out of sale (via a clear “Do Not Sell My Info” link).
- Other FTC-style rights: notice, choice, access, security, and enforcement.
9. Consent & Opt-In/Opt-Out Mechanisms
- EU/UK: Explicit opt-in required for marketing and analytics; easy withdrawal available.
- U.S.: Opt-out options in every marketing message (unsubscribe links), and clear “Do Not Sell” link if applicable (especially for California).
10. Security Measures
Our security measures include data encryption, access restriction, secure storage, and regular reviews — aligning with GDPR’s integrity/confidentiality principles and FTC guidance.
11. Children’s Privacy
Our services are not directed at children under 16. We do not knowingly collect personal data from minors; if discovered, we’ll promptly delete it.
12. Updates to This Policy
This policy may be updated. We’ll publish changes here, and if substantial, provide prominent notice or direct communication.