PRIVACY POLICY

PRIVACY POLICY

Tour Shark respects the privacy of its website visitors, in particular their rights regarding the automatic processing of personal data. We have therefore formulated and implemented a privacy policy on complete transparency with our customers regarding the processing of personal data, its purpose(s) and the possibilities in accordance with the applicable data protection legislation to exercise your legal rights in the best possible way.

If you require any additional information about the protection of personal data, please visit the website of the Dutch Data Protection Authority (Autoriteit Persoonsgegevens): https://autoriteitpersoonsgegevens.nl/nl.

The current available version of this privacy policy is the only version that applies while visiting our website until a new version, due to changes for example in services or laws, replaces the current version. We therefore ask that you keep yourself informed of its contents.

Article 1 – Definitions

1. Party responsible for processing personal data (hereinafter: “Tour Shark”, ): the controller established at Groesbeekseweg 25, 6511 KE Nijmegen, The Netherlands, Chamber of Commerce number: 69470278 
2. Website (hereinafter: “Website”): https://tour-shark.com.

Article 2 – Collection of data

Tour Shark processes data that you yourself provide to us by using our website and our service. This concerns the following data: 

1. Login information: first name, last name, telephone number and e-mail address 
2. Booking information: Country, address, postal code, town/city, phone number and business name (in case provided).
3. Review information: name (in case provided) and review 
4. Payment Confirmation Data: When you pay using third-party providers like PayPal or Stripe, we do not collect or store your full financial details (like complete credit card numbers or bank account details). However, we receive confirmation data from the chosen payment processor necessary to confirm the transaction, which may include your name, email address, part of your card number (e.g., last four digits), transaction ID, payment status, and potentially the billing address you provided to the processor.

Some of this data (as specified in Article 9 and 10) will be shared with the relevant activity provider or payment processor in order to arrange the service or process the payment.  

Article 3 – The lawfulness of processing data

1. The legal basis for the processing of the login information and booking information, as well as sharing necessary data with suppliers and payment processors (PayPal, Stripe), is that the processing is necessary for the performance of a contract with the Supplier (facilitated by Tour Shark) or in order to take steps at your request prior to entering into a contract (Article 6(1)(b) GDPR).
2. The legal basis in regards to the review information is consent on the basis of Article 6 (1) sub a of the GDPR, which you have given to us by publishing the review on our website. You have the right to revoke your consent by contacting us on info@tour-shark.com.

Article 4 – The purposes of the processing data

Tour Shark processes your personal data using the abovementioned legal basis and we process your personal data for the following purposes:

1. To execute your order, confirm your booking, and facilitate the provision of the service by the Supplier. Data is recorded in an (electronic) register for this purpose.
2. To maintain a (commercial) relationship with you, including necessary communications regarding your bookings or account.
3. To understand how users use our website so that we can improve the performance and provide better services.
4. To improve the website and the services offered.
5. To allow you to provide reviews of your experiences.
6. To process your payments securely via our integrated third-party payment providers, specifically PayPal and Stripe.
7. To share necessary transaction information with your chosen payment provider (PayPal or Stripe) for payment completion, fraud prevention, chargeback management, and regulatory compliance.
8. To reconcile payments received with bookings made.

Article 5 – Collected data and commercial offers

1. You may receive commercial offers from Tour Shark if you have opted-in to receive them. If you do not wish to receive them (anymore), please send us an email to the following address: info@tour-shark.com or use the unsubscribe link provided in the emails.
2. Your personal data will not be sold to third parties for commercial purposes. We only share data with partners as described in this policy (e.g., Suppliers, Payment Processors) as necessary to provide our service.   
3. If you encounter any personal data from other data subjects while visiting our website, you are to refrain from collection, any unauthorized use or any other act that constitutes an infringement of the privacy of the data subject(s) in question. Tour Shark is not responsible in these circumstances.

Article 6 – Is it necessary to provide data?

When Tour Shark asks for your personal data, our starting point is that the requested personal data is necessary for the aforementioned purposes. The provision of personal data (like login, booking, and payment details) is a necessary condition to conduct a contract with the Supplier via Tour Shark. If you do not want to provide the necessary personal data, you cannot make use of our services.

Article 7 – Data retention

The collected data are used and retained for the duration that is necessary to achieve the purpose for which your data is collected, and to comply with legal obligations (e.g., financial record keeping). As soon as you delete your account on the website, personal data linked solely to the account and not required for other purposes (like completed transaction records) will be removed or anonymized where feasible. Tour Shark will retain necessary data (e.g., booking and transaction records) generally for a period as required by Dutch law (e.g., financial administration often requires 7 years), after which it will be destroyed or anonymized, unless there is a legal requirement or justification (like an ongoing dispute) to retain it longer.

When the retention period has expired, the data will be deleted or anonymized, unless it is intended for legitimate historical, statistical or scientific purposes in an anonymized format.

Article 8 – Your rights regarding data

Pursuant to chapter 3 of the GDPR you have access to the following rights regarding your personal data processed by Tour Shark. These will be briefly explained below:

1. Right of access: the right to obtain a confirmation whether or not Tour Shark has processed personal data concerning you and, where that is the case, access to the personal data.
2. Right of rectification: the right to obtain rectification of inaccurate personal data. 
3. Right to erasure ('right to be forgotten'): the right to obtain erasure of personal data under certain conditions (e.g., data is no longer necessary, consent is withdrawn and there's no other legal ground, processing is unlawful). This right is subject to limitations, such as legal retention obligations.
4. Right to Restriction of processing: the right to obtain restriction of processing personal data under specific circumstances. In short this means that Tour Shark will temporarily “freeze” the processing of your personal data if you contest its accuracy, the processing is unlawful but you oppose erasure, Tour Shark no longer needs the data but you require it for legal claims, or you have objected to processing pending verification.

• Pending the assessment of a correction request;
• In case data processing is unlawful, but you oppose erasure and request restriction instead;
• If Tour Shark no longer needs the personal data for its purposes, but you need the personal data for the establishment, exercise or defence of legal claims;
• Pending the verification whether the legitimate grounds of Tour Shark override yours, following an objection request.

5. Right to object: the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on legitimate interests (Article 6(1)(f) GDPR). You also have the absolute right to object to processing for direct marketing purposes.
6. Right to data portability: the right to receive personal data concerning you, which you have provided to Tour Shark, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from Tour Shark, where processing is based on consent or contract and is carried out by automated means.

You can exercise these rights by contacting us at info@tour-shark.com. Each request must be accompanied by sufficient information to verify your identity (we may request a redacted copy of a valid ID if necessary, ensuring sensitive data like photo and national identification number are blacked out). Please state clearly which right you wish to exercise and provide the address where we can contact you. We will respond within one month of the receipt of your request. Depending on the complexity and the number of the requests this period may be extended by two further months where necessary, in which case we will inform you of any such extension within one month of receipt of the request, together with the reasons for the delay.. 

Article 9 – Data transfer to Suppliers

To enable the provision of the booked tour, activity or experience, Tour Shark provides necessary details to the respective Supplier. This typically includes your name, contact information (such as e-mail address or telephone number provided during booking), booking details (like date, time, number of participants), and any specific requests you made relevant to the activity. This transfer is necessary for the performance of the contract between you and the Supplier.

Article 10 – Data Transfer to Payment Processors (PayPal and Stripe)

1. To process payments for bookings made on the Tour Shark Platform, we utilize the services of third-party payment processors, primarily PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg) and Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland).
2. When you choose to pay via PayPal or Stripe, we must share certain personal data with your chosen processor to enable the processing of your payment. This necessary data typically includes your name, email address, billing address (if applicable), order details (description of service, amount, currency), and potentially other information required by the processor for transaction verification, security, and fraud prevention (like IP address or device information).
3. Both PayPal and Stripe act as independent data controllers for the payment processing services they provide. This means they process your data, including data you provide directly to them during the payment flow (like full card details entered on their secure forms), in accordance with their own privacy policies. We strongly encourage you to review the privacy policy of the payment provider you choose:
   • PayPal's Privacy Statement: [Optional: Add Link to PayPal Privacy Policy]
   • Stripe's Privacy Policy: [Optional: Add Link to Stripe Privacy Policy]
4. Your use of PayPal's or Stripe's services may involve the transfer of your personal data to countries outside the European Economic Area (EEA), including the United States. Both PayPal and Stripe implement legally recognized mechanisms (such as Standard Contractual Clauses or Binding Corporate Rules) to ensure that such transfers are adequately protected as required by GDPR. Please refer to their respective legal agreements and privacy policies for details on international data transfers and the safeguards they employ.

Article 11 – Data transfer to hotels 

In some cases, Tour Shark may provide anonymised or aggregated data to partner hotels (e.g., regarding booking volumes originating from guests). This data is processed in a way that the identity of an individual person cannot be derived from it. This might include the number of bookings made and the underlying costs, for statistical or partnership reporting purposes.

Article 12 – Automated individual decision-making, including profiling

Tour Shark does not use automated individual decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you.

Article 13 – Access to the website

Access to and use of the website are strictly personal. You will refrain from using the data and information of this website for your own commercial, political or advertising purposes, as well as for any commercial offers, in particular unsolicited electronic offers.  

Article 14 – Website content  

All brands, images, texts, comments, illustrations (animated) images, video images, sounds and all the technical applications that can be used to operate this website and more generally all the components used on this website, are protected by the laws on intellectual property. Any reproduction, repetition, use or modification, by any means whatsoever, of all or just part of it, including technical applications, without the prior written permission of Tour Shark, is strictly prohibited. The fact that Tour Shark may not take immediate action against any infringement, cannot be considered as a tacit consent, nor of a waiver of any right to prosecute the infringing party.

Article 15 – Management of the website

For the purpose of proper management of the site, Tour Shark may at any time:

• suspend, interrupt, reduce or decline the access to the website for a particular category of visitors or for all visitors, for maintenance or other reasons.
• delete all information that may disrupt the functioning of the website or conflicts with national or international laws or is contrary to internet etiquette.
• make the website temporarily unavailable in order to perform updates or maintenance.

Article 16 – Responsibilities

1. Tour Shark is not liable for any failure, disturbances, difficulties or interruptions in the functioning of the website, causing the (temporary) inaccessibility of the website or of any of its functionalities, unless caused by its gross negligence or wilful misconduct. You, yourself, are responsible for the way you seek connection to our website and for securing your connection. You need to take all appropriate steps to protect your equipment and data against hazards such as virus attacks on the Internet. Furthermore, you are responsible for which websites you visit and what information you seek.
2. Tour Shark is not liable for any legal proceedings taken against you because of your use of the website or services accessible via the Internet, or for your violation of the terms of this privacy policy or the User Agreement.
3. Tour Shark is not liable for any damages that incur to you or third parties or your equipment, as a result of your connection to or use of the website, unless caused by its gross negligence or wilful misconduct. You will refrain from any subsequent (legal) action against Tour Shark related to such connection or use.
4. If Tour Shark becomes involved in a dispute because of your (ab)use of this website, it is entitled to (re)claim all subsequent damages from you.

Article 17 – Data security measures 

Tour Shark has taken appropriate technical and organizational measures to protect your personal data against loss or against any unlawful or unauthorized form of processing, considering the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons. The software and systems used are secured according to industry standards. Access to personal data is restricted on a need-to-know basis to employees or contractors of Tour Shark who require access for the purpose of their work and are subject to confidentiality obligations. Our security measures are evaluated regularly and updated where necessary to reflect technological advances or changing risks. Tour Shark demands similar appropriate technical and organizational measures from third-party organizations who process data on our behalf (processors). Payment processors like PayPal and Stripe are responsible for securing the data processed within their own systems according to their high security standards (e.g., PCI-DSS compliance).

Article 18 – Dutch Data Protection Authority (Autoriteit Persoonsgegevens)

In addition to the possibility of submitting a complaint to Tour Shark (at info@tour-shark.com), you have the right to submit a complaint to the competent supervisory authority for the protection of personal data, in this case the Autoriteit Persoonsgegevens (AP) in The Netherlands. You can contact the AP via their website: https://autoriteitpersoonsgegevens.nl/nl.

Article 19 – Legal obligations

1. In case of infringement of any law or regulation, of which a visitor is suspected and for which the authorities require the personal data collected by Tour Shark, these data will be provided to them after an explicit, reasoned, and legally valid request from those authorities, after which these personal data may no longer fall under the protection of the provisions of this Privacy policy.
2. If any information is necessary in order to obtain access to certain features of the website or complete a transaction, Tour Shark will indicate the mandatory nature of this information when requesting these data.

Article 20 – Imagery and products offered

You cannot derive any rights from the imagery that accompanies any offered product or service description on our website. Images are for illustrative purposes. Refer to the detailed description for service specifics.

Article 21 – Applicable Law

These conditions are governed by Dutch law. The court in the district where Tour Shark has its place of business (currently Arnhem, subject to rules of competence) has the primary jurisdiction if any dispute regarding these conditions may arise, save when a mandatory legal exception applies (e.g., consumer protection rules granting jurisdiction to the consumer's place of residence).

Article 22 – Contact

For questions about this privacy policy, your personal data, product information or information about the website itself, please contact: Tour Shark VOF via email at info@tour-shark.com