Privacy Policy

We collect information you provide directly to us and information collected automatically when you use the website.

• Booking and contact details — your name, email address, phone number, nationality, number of travellers, and the experiences, dates and options you select.
• Payment information — when card payments are available, card details are collected and processed directly by our payment provider (Stripe). We do not store your full card number on our servers.
• Communications — messages you send us by email, WhatsApp, contact forms or phone, and our replies.
• Automatically collected data — IP address, device and browser type, pages viewed, and similar analytics data collected through cookies and similar technologies.

We use your personal information to:

• Process, confirm and manage your bookings and payments;
• Communicate with you about your booking, including confirmations, changes, cancellations and support;
• Provide customer service and respond to your enquiries;
• Operate, maintain, secure and improve our website and services;
• Send you service-related messages and, where you have consented, marketing communications; and
• Comply with legal obligations and prevent fraud or misuse.

We do not sell your personal information. We share it only as necessary to provide our services:

• Experience suppliers and operators — we share the details needed to fulfil your booking (such as your name, travel date and number of travellers) with the tour operator or activity provider, including through our booking and reservation partner (Bokun).
• Payment processors — card payments are handled by Stripe under their own terms and privacy policy.
• Service providers — hosting, analytics, communication and IT providers who process data on our behalf under appropriate confidentiality obligations.
• Legal and safety — authorities or third parties where required by law, to enforce our terms, or to protect the rights, property or safety of our customers, our company or others.

We are based in Dubai, United Arab Emirates. Some of our service providers may process your information in other countries. Where information is transferred outside the UAE, we take reasonable steps to ensure it is protected in line with this Policy and applicable law.

We use cookies and similar technologies to keep the website working, remember your preferences (such as language and currency), and understand how the website is used so we can improve it. You can control cookies through your browser settings; disabling some cookies may affect how the website functions. You can also change or withdraw your consent to advertising and measurement cookies at any time with the "Cookie settings" control at the bottom of every page, which reopens the consent choice.

We use Microsoft Clarity, a session-recording and heatmap service run by Microsoft, to see how visitors use our pages — where they click, tap and scroll, and where they get stuck — so that we can fix what is confusing. Clarity records how a page is used (clicks, taps, scrolling, mouse movement, the pages you visit and the page content shown) and sets first-party cookies (_clck and _clsk) and, through Microsoft, third-party cookies that identify your browser. Anything you type into a form is masked and never leaves your browser, and we also mask your contact details, booking code, and pickup and drop-off points where they are shown. Clarity does not run on our staff screens or on personal review links. If you are in the European Economic Area, the United Kingdom or Switzerland we start it only after you accept cookies; wherever you are, you can decline or withdraw with the "Cookie settings" control, which removes its cookies and stops it. Microsoft's use of this data is described in the Microsoft Privacy Statement (https://privacy.microsoft.com/privacystatement).

We also record how you reached our website — the site or campaign that sent you, such as a search engine, a social network or an AI assistant like ChatGPT — together with the first page you landed on, and store it with your booking so that we know which channels bring bookings. We keep this record in a cookie of our own (hy_attr) for up to 90 days, on the same consent terms as our advertising cookies, and we do not send it to any advertising platform.

When you arrive at our website through a Google or Meta (Facebook/Instagram) advertisement, we capture the ad's click identifier — such as a gclid or fbclid — and store it against your booking. We also store two things that are not tied to any advertisement: an identifier Meta's own pixel places in your browser (the _fbp cookie), which is set on an ordinary visit and not only after an ad click, and the user agent string your browser sends with every request, which describes your browser and device.

Google receives information about your visit through its own tags running in your browser: the pages you view and the steps of a booking, including that a booking was completed and its value. When a booking is completed, those tags may also send Google the email address and phone number you gave us at checkout, in hashed form only: each is converted in your browser, before it is sent, into a one-way code that cannot be reversed to recover the original value. Google uses these codes to match the booking to an advertisement you saw or clicked, which tells us which bookings our advertising led to (Google calls this "enhanced conversions"), and its tags send them only if you accepted advertising cookies or, if you were not asked for a choice, only if you have not declined them through "Cookie settings". Google's use of this data is described in its help page on enhanced conversion data (https://support.google.com/adspolicy/answer/9755941). In addition, if you arrived through a Google advertisement, then when your booking is confirmed our servers may send Google that advertisement's click identifier (the gclid, or the wbraid or gbraid Google uses on some Apple devices), together with the booking's reference, value and currency and the time it was confirmed, so that Google can match the booking to the advertisement. We do this only on the same consent terms as the Meta report described below: only if you accepted advertising cookies or, if you were not asked for a choice, only if you have not declined them through "Cookie settings". Our servers never send Google your name, email address or phone number.

Meta receives the same kind of information from its pixel in your browser. In addition, when a booking is confirmed, our servers report it to Meta — but only if you accepted advertising cookies or, if you were not asked for a choice, only if you have not declined them through "Cookie settings". That report includes your name, email address and phone number in hashed form only: each is converted, before it leaves our systems, into a one-way code that cannot be reversed to recover the original value. It also includes, without hashing, the Meta identifiers described above (the click identifier derived from an fbclid, and the _fbp cookie) and your browser's user agent string, because Meta needs them in that form to match the booking to its advertisement. If you decline, we do not send Meta this report. We never send your name, email address or phone number in plain text, we do not sell this information to anyone, and we use it only to measure and improve advertising performance — for no other purpose.

We keep your personal information for as long as needed to provide our services and bookings, and thereafter for as long as necessary to comply with our legal, accounting, tax and regulatory obligations, to resolve disputes and to enforce our agreements.

We use appropriate technical and organisational measures to protect your personal information against unauthorised access, loss or misuse. However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

Subject to applicable UAE data protection law, you may have the right to access, correct, update or request deletion of your personal information, to object to or restrict certain processing, and to withdraw consent for marketing at any time. To exercise these rights, contact us using the details below. We may need to verify your identity before acting on your request.

Our website and services are intended for adults. We do not knowingly collect personal information from children under 18 without the consent of a parent or guardian. Bookings that include children are made by the responsible adult who books.

We may update this Privacy Policy from time to time. The updated version will be posted on this page with a revised "last updated" date. Your continued use of the website after changes take effect means you accept the updated Policy.

If you have questions about this Privacy Policy or how we handle your personal information, contact us:

Holidays Tours LLC

Dubai, United Arab Emirates

Email: info@holidayys.com