Privacy Policy | GrandTour (Pvt) Ltd

1Information we collect

We collect and process various types of data to provide our services effectively.

Information you provide directly, such as:

Contact information: name, email address, WhatsApp number and mobile number.
Booking details: tour preferences, travel dates, and any other details you provide to facilitate your booking.

Data collected automatically when you interact with our website:

IP address.
Browser type and version.
Device information, such as operating system and screen resolution.
Usage data, including the pages you visit, the time spent on each page, and clickstream data.

When you make a payment we collect the details necessary for transaction processing through our third-party payment gateway. This includes:

We do not store your full credit or debit card details. Payment information is processed securely by our payment partner.

We use your data for the following purposes.

To analyse website performance and enhance navigation using tools like Google Analytics.

With your consent we may send newsletters, promotions and updates about new tours or services. You can opt out of these communications at any time.

We do not sell or rent your personal data to third parties. However, we may share your data with:

Service providers: hotels, transport operators and tour guides involved in your booking.
Payment processors: our third-party payment gateway, which securely processes your payment information.
Analytics providers: Google Analytics, used to track website traffic and user behaviour.
Legal obligations: if required by law, we may share data with law enforcement or government agencies.

If you are an EU resident, you have the following rights under the GDPR:

Right to access — request a copy of the personal data we hold about you.
Right to rectification — correct any inaccurate or incomplete data.
Right to erasure — request the deletion of your data, unless it is required for legal or administrative purposes.
Right to object — opt out of data processing for specific purposes, such as marketing.
Right to data portability — receive your data in a structured, machine-readable format.
Right to withdraw consent — withdraw your consent to data processing at any time.

We use the following measures to protect your data:

SSL encryption: all data transmitted between your browser and our servers is encrypted.
Access controls: only authorised personnel can access your data.
Regular security audits: we periodically review our systems to prevent vulnerabilities.

We retain your personal data for as long as necessary to fulfil the purposes outlined in this policy, or to comply with legal obligations.