1. Controller
The controller of your personal data is TourCierge s. r. o., Karpatské námestie 10A, 831 06 Bratislava – Rača, Slovakia, IČO 57383898. For any privacy question or request, contact us through our contact page.
2. What we collect and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Name, email address, cruise date, number and type of tickets | Process your order, send your QR tickets and order emails, handle questions and complaints | Performance of a contract – Art. 6(1)(b) |
| Order and payment records (amount, date, payment reference) | Accounting and tax obligations | Legal obligation – Art. 6(1)(c) |
| Messages you send via the contact form | Answer your request | Legitimate interest – Art. 6(1)(f), or contract where it concerns your order |
| Technical data (IP address, browser, server logs) | Keep the website secure and working, prevent fraud | Legitimate interest – Art. 6(1)(f) |
| Analytics and marketing cookies | Measure and improve the website and our ads | Your consent – Art. 6(1)(a); see our Cookie Policy |
Your card details are entered directly on Stripe's payment page; we never receive or store them. We do not use your data for automated decision-making or profiling, and we do not sell it.
3. Who we share it with
We use trusted service providers (processors) who act only on our instructions:
- Stripe – payment processing (Stripe also acts as an independent controller for its own fraud-prevention and legal obligations).
- Resend – delivery of ticket and order emails.
- Vercel – website hosting.
- Our database hosting provider – storage of order and ticket records.
- Google – advertising measurement, only if you accept marketing cookies.
Ticket information may be shared with the cruise operator where needed to validate your tickets. We also disclose data to authorities where the law requires it.
4. Transfers outside the EU
Some providers are based in, or access data from, the United States. In these cases transfers rely on the EU–US Data Privacy Framework or on the European Commission's Standard Contractual Clauses.
5. How long we keep it
- Order data needed for accounting: 10 years, as required by Slovak accounting law.
- Other order data (e.g. ticket codes linked to your email): up to 3 years after the cruise date, for complaints and legal claims.
- Contact form messages: up to 2 years after the matter is closed.
- Your cookie choice: 12 months, after which we ask again.
6. Your rights
You have the right to:
- access your personal data and receive a copy;
- have inaccurate data corrected;
- have your data erased where there is no longer a legal reason to keep it;
- restrict or object to processing based on our legitimate interests;
- data portability for data you provided to us under a contract;
- withdraw your consent at any time (for cookies via "Cookie settings" in the footer).
To exercise these rights, contact us through our contact page. We reply within one month. You also have the right to lodge a complaint with the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov SR, dataprotection.gov.sk) or with the data protection authority of your EU country of residence.
7. Do you have to provide your data?
Your name and email address are needed to buy tickets: without them we cannot deliver your QR tickets. All other data and consents are optional.
8. Changes
We may update this policy. The current version is always available on this page.