Privacy Policy

Wow A Tour Ltd (registered at Companies House as WOW A TOUR LIMITED) is the controller of the personal information described in this policy. This means we decide how and why it is used.

Wow A Tour Ltd is registered in England and Wales under company number 11426960. Registered office: Kintyre House, 70 High Street, Fareham, Hampshire, United Kingdom, PO16 7BB.

This policy applies to Villefranche Shore Excursions and to our other shore excursion brands, which are trading names of Wow A Tour Ltd:

• Villefranche Shore Excursions (villefrancheshoreexcursions.com)
• Santa Cruz Shore Excursions (santacruzshoreexcursions.com)
• Savona Shore Excursions (savonashoreexcursions.com)
• Tangier Shore Excursions (tangiershoreexcursion.com)
• Tarragona Shore Excursions (tarragonashoreexcursions.com)
• Toulon Shore Excursions (toulonshoreexcursions.com)
• Trieste Shore Excursions (triesteshoreexcursions.com)
• Valencia Shore Excursions (valenciashoreexcursion.com)
• Venice Shore Excursions (veniceshoreexcursion.com)
• Vigo Shore Excursions (vigoshoreexcursions.com)
• Volos Shore Excursions (volosshoreexcursions.com)
• Zadar Shore Excursions (zadarshoreexcursions.com)

All our brands share one customer service team, one email address and one WhatsApp Business account, so this policy applies whichever brand you contact or book with.

For privacy questions or requests, email info@wowatour.com.

Depending on how you deal with us, we may collect:

• Contact details: your name, email address and phone number.
• Booking details: the excursion, date, cruise ship, number of adults and children, booking reference, and any requests or messages about your booking.
• Payment details: whether your payment succeeded, the amount, and any refund. Card details are collected by our payment provider, Stripe. We never receive or store your full card number.
• Messages you send us by email or WhatsApp, including any attachments.
• WhatsApp details: your WhatsApp phone number and profile name, and technical information about messages (see “WhatsApp” below).
• Accessibility, mobility or medical information, only if you choose to tell us. Our booking form does not ask for it. After you book, we invite you to email us anything your guide should know, such as access needs.

If you give us details of other people in your group, please make sure they know you are doing so.

If you book one of our excursions through another booking platform, that platform passes us the details we need to deliver your booking. Its own privacy policy explains how it uses your information.

We use your information to respond to enquiries, take and manage bookings and payments, provide meeting instructions, communicate about your excursion, deal with changes, cancellations, refunds and complaints, and keep our business records.

UK data protection law requires us to have a lawful basis for each use. We rely on:

• Contract: to answer your questions before you book, and to take, manage and deliver your booking, including passing the necessary details to the local excursion provider.
• Legitimate interests: to answer general enquiries, keep a record of our correspondence with you, keep our websites and systems secure and working, and improve our service. We only do this in ways you would reasonably expect, and you can object (see “Your rights”).
• Legal obligation: to keep accounting and tax records.

If you choose to tell us about accessibility, mobility or medical needs, we use that information only to arrange your excursion: to check whether it is suitable for you and to tell the local excursion provider what they need to know. Please share only what is needed for this.

To make a booking we need your name, a way to contact you and your booking details. Everything else is optional.

If you pay online, you are taken to a secure payment page provided by Stripe. Stripe collects your card details and may also ask for your email address and phone number. Stripe handles card details according to its own security and privacy terms.

We receive the payment confirmation details needed to manage your booking, not your full card number.

We will never ask you to send card details by email or WhatsApp.

We use your contact details to send booking-related messages such as confirmations, meeting instructions and responses to your questions.

When you pay online, our booking system sends an internal email with your booking details to our team, so that we can prepare your booking. We do not send automated emails to customers.

Our customer service email uses Google’s email services.

We will not send you marketing by email or WhatsApp unless you have agreed to receive it where the law requires this, and you can opt out at any time.

We are preparing to use the WhatsApp Business Platform (Cloud API), provided by Meta, to receive and reply to WhatsApp messages for all our brands.

While this is being set up, messages sent to our WhatsApp Business number may not be read or answered straight away. For anything urgent, please email info@wowatour.com.

When you message us on WhatsApp, Meta passes us your WhatsApp phone number, your WhatsApp profile name, the content of your message and any attachments, and technical details such as message identifiers, timestamps and delivery status. We will use your messages only to respond to you and to help with your booking.

At present:

• Our server accepts a message notification only if it carries Meta’s valid digital signature.
• We keep minimal diagnostic logs about each message: the last four digits of the phone number (the rest is masked), a scrambled (hashed) reference to the message, the message type, timestamps and delivery status. These logs do not contain message content or names, and are deleted automatically within 7 days.
• We do not keep a database of WhatsApp conversations.
• We do not send automated replies, and we do not use AI to read or reply to messages.

Meta processes WhatsApp messages for us as our service provider and keeps WhatsApp Cloud API message data for up to 30 days to operate the service, for example to retry delivery. Meta also uses some information for its own purposes, such as keeping WhatsApp safe and secure. That use is covered by WhatsApp’s own privacy policy.

WhatsApp messages are encrypted between your device and Meta. Because we use Meta’s Cloud API, Meta decrypts messages on our behalf and delivers them to us over an encrypted connection.

Please do not send payment card numbers, bank details, passport or ID numbers, or detailed medical information by WhatsApp.

We will update this policy before we start storing WhatsApp or email conversations in a customer service system, or introduce AI-assisted replies.

We share only what is needed to provide the service you requested. We may share your information with:

• The local excursion provider that operates your excursion, which receives the booking details it needs to run the tour.
• The booking platform you booked through, if you did not book with us directly.
• Service providers that help us run our business: Cloudflare (website hosting, security, our booking database, and email forwarding for some of our website addresses), Stripe (online payments), Google (email services), Resend (sends the internal email that tells our team about each new online booking, including your name, contact details and booking details), Meta (WhatsApp Business Platform), and other IT providers that host our internal booking-management system.
• Professional advisers, and authorities where the law requires it.

When you book online, your booking details (your name, email address and phone number, the excursion, date, cruise ship, number of guests, amount paid and payment references) are stored in our booking database, which is provided by Cloudflare and currently runs in Western Europe. We also keep a record there of the internal booking email sent to our team: when it was sent and its subject line, which shows your booking reference and excursion date.

We do not sell your personal information.

Some of our service providers may process information outside the UK, including in the United States. When personal information is transferred outside the UK, UK data protection law requires it to be protected, for example by UK adequacy regulations or by contractual safeguards.

The data protection terms published by our main providers cover these transfers as follows:

• Meta (WhatsApp): the UK International Data Transfer Addendum to the EU standard contractual clauses, for transfers to Meta Platforms, Inc. in the United States.
• Cloudflare: the EU standard contractual clauses as amended by the UK International Data Transfer Addendum.
• Stripe: recognised transfer mechanisms, including the UK International Data Transfer Addendum and the UK extension to the EU–US Data Privacy Framework.
• Google (email services): Google LLC’s certification to the UK extension to the EU–US Data Privacy Framework.
• Resend (booking notification emails): stores email data in the United States. Transfers are covered by the EU standard contractual clauses as amended by the UK International Data Transfer Addendum, and by Resend’s certification to the UK extension to the EU–US Data Privacy Framework.

Some local excursion providers are based outside the UK. We share your booking details with them because this is necessary to provide the excursion you booked.

Contact us if you would like more information about these safeguards.

This website and our online booking system use encrypted (HTTPS) connections.

When you pay online, you enter your card details on Stripe’s secure payment page, so we never receive your full card number.

We access our booking and customer records through our service providers’ online accounts, which require us to sign in.

Our WhatsApp connection only accepts messages carrying Meta’s valid signature. Our technical logs mask phone numbers and do not contain message content.

No system is completely secure. If a data breach is likely to put your rights at high risk, we will tell you, as the law requires.

How long we keep information depends on why we hold it:

• Booking records, including related emails: for as long as we need them to provide your excursion, deal with your questions, changes, complaints or claims, and meet our tax and accounting obligations.
• Payment and accounting records: for as long as UK law requires us to keep accounting and tax records.
• Emails and enquiries that do not lead to a booking: for as long as we need them to deal with your enquiry and any follow-up.
• Our WhatsApp technical logs: deleted automatically within 7 days.
• WhatsApp Cloud API message data held by Meta: up to 30 days.

We are reviewing how long we keep booking records and emails, and will update this policy when we set specific periods.

If a complaint or legal claim is ongoing, we may keep the relevant records until it is resolved.

This website does not use analytics, advertising or tracking cookies.

Our booking form keeps your booking choices in your browser’s session storage so that you do not lose your progress. This is cleared when you close the browser tab.

When you pay, Stripe’s payment page may use its own cookies, as described in Stripe’s policies. Cookies and analytics on our other brand websites are described on those websites.

Under UK data protection law, and subject to some conditions and exceptions, you have the right to:

• ask for a copy of the personal information we hold about you;
• ask us to correct information that is inaccurate or incomplete;
• ask us to delete your information (see “How to ask us to delete your data” below);
• ask us to restrict how we use your information;
• object to our use of your information where we rely on legitimate interests, and object at any time to direct marketing;
• ask for information you gave us in a portable format, where we rely on contract or consent;
• withdraw your consent at any time, where we rely on consent.

To make a request, email info@wowatour.com. We may need to confirm your identity. We will respond within one month, or tell you within that month if we need up to two more months for a complex request. There is normally no fee.

We do not make decisions about you based solely on automated processing.

If you are unhappy with how we have handled your information, please contact us at info@wowatour.com first. We will acknowledge your complaint within 30 days, investigate it and tell you the outcome.

You can also complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.

If you are in the European Union, you may also have rights under EU data protection law, including the right to complain to the data protection authority where you live.

You can ask us to delete the personal information we hold about you, including information from your WhatsApp messages and emails.

1. Email info@wowatour.com with the subject line “Delete my data”.
2. Tell us the WhatsApp number and/or email address you used to contact us, and any booking reference.
3. We may ask you to confirm the request from that email address or phone number, so that we know it is really you.

Unless one of the exceptions below applies, we will then delete your contact details and any copies of your messages and attachments held in our email, booking and customer service records, and confirm by email when this is done. We will do this within one month, or tell you within that month if we need longer (up to two further months for complex requests).

We may need to keep some information where the law requires or allows it, for example accounting records of a payment, information needed for an ongoing complaint or legal claim, and a short record of your request so that we can show we acted on it. If we have shared your details with a local excursion provider, we will tell them about your request unless this is impossible or involves disproportionate effort.

WhatsApp: our own WhatsApp technical logs contain only the last four digits of your number and are deleted automatically within 7 days. Meta deletes WhatsApp Cloud API message data within 30 days. Deleting a chat on your own phone does not delete copies held by us or Meta, and blocking our number stops new messages but does not delete existing information. Information Meta holds about your WhatsApp account is covered by WhatsApp’s own privacy policy and settings.

If you booked through another booking platform, please also contact that platform to delete the information it holds.

We will update this policy when our practices change, including before we start storing WhatsApp or email conversations in a customer service system or introduce AI-assisted replies. The “Last updated” date at the top of this page shows when it last changed.

Privacy enquiries: info@wowatour.com

Wow A Tour Ltd, registered in England and Wales under company number 11426960. Registered office: Kintyre House, 70 High Street, Fareham, Hampshire, United Kingdom, PO16 7BB.