Privacy Policy

1. Who we are

Viazo Ltd is the controller of the personal data described in this policy, except where this policy says otherwise. We are registered in England and Wales (company number 16385873), registered office Flat 1, 69 Camberwell Grove, London, SE5 8JE.

You can reach us about anything in this policy at info@viazo.co.uk.

2. Where a tour company is the controller instead

When you book, the tour itself is supplied by the company or guide running it, not by Viazo. We pass them what they need to deliver your booking — your name, party size, contact details and anything you have told us you need. From that point they are an independent controller of that data and their own privacy policy applies to what they do with it.

They are permitted to use it to deliver and support your booking, and for nothing else, unless you have separately agreed to hear from them. See section 6.

3. What we collect

If you book a tour: your name and email address, a phone number if you give one, the size and composition of your party, the tour and departure you chose, what you paid, and any requirements you tell us about. You do not need an account to book.

If you list tours: your name, email address, phone number, business details including company and VAT number and address, your tours and schedules, your guides’ names and contact details, and payout information held by Stripe.

If you connect a mailbox so that bookings from other platforms appear in your Viazo dashboard: an access token for that mailbox, and the contents of the booking confirmation emails we read from it — which contain your customers’ names, email addresses and booking details. We read only messages that look like booking confirmations, and we store only the booking details extracted from them.

If you are listed on the Marketplace: your business name, address, contact details, photographs and offer details, and records of discount codes issued and redeemed at your premises.

Everyone: anonymous page view counts, and the technical information any web server receives. We do not build advertising profiles of visitors.

4. Why we use it, and our lawful basis

Where we rely on legitimate interests, we have considered whether it is fair to you and you can object — see section 9.

5. Who we share it with

We do not sell personal data. We share it with the tour company running your tour, as described in section 2, and with service providers who process it on our behalf under contract:

• Stripe — payments and payouts. Card details go to Stripe directly and we never see them.
• Resend — sending email such as booking confirmations and reminders.
• Cloudinary — storing and serving images.
• Vercel and Neon — hosting the website and the database.
• Anthropic — reading connected mailboxes to extract booking details from confirmation emails, where you have connected a mailbox. The email content is sent for processing and is not used to train models.
• Google and Microsoft — access to a connected Gmail or Outlook mailbox, where you have authorised it.
• Google — advertising measurement, which tells us that a booking followed an advert without identifying you to us.
• Shippo — arranging delivery where a Marketplace order is posted.
• Bounce — our luggage storage partner, where you book storage.
• postcodes.io — looking up a postcode you type.

We also disclose data where the law requires it, and to professional advisers where necessary.

6. Marketing, and consent given to a tour company

Some tour companies ask, when you book, whether you would like to hear from them. If they do, you will see a separate, unticked box with their own wording in it. Booking never depends on whether you tick it, and we never tick it for you.

If you do tick it, we record the exact words you were shown, the date, and which company they named, and we pass your name and email address to that company. That recorded wording is the limit of what they are allowed to send you: they may not use your details for anything it does not describe, may not pass them to anyone else, and may not sell them.

You can withdraw at any time. Every marketing email must carry a way to opt out. You can use the link in any such email, or email us and we will remove you. Withdrawing through either of us removes you from both. We keep a record that consent was given and then withdrawn, so that we can show why your details were held and when that stopped — that record is not itself used to contact you.

Withdrawing marketing consent does not affect emails about a booking you have made. Those are part of the booking itself.

7. How long we keep it

• If you have an account with no bookings and have not used it for two years, we delete it.
• Where all of your bookings are more than six years old, we remove the personal details from them and keep the financial record, because tax law requires it.
• Page view counts are deleted after twelve months.
• Marketing consent records are kept for as long as the consent is relied on, and the record of a withdrawal is kept afterwards as evidence that it happened.

This runs automatically each month rather than on request.

8. Where your data is held

Our database and hosting are in the United Kingdom or the European Economic Area. Some of the providers in section 5 are based in the United States; where data reaches them it is transferred under the UK International Data Transfer Agreement or the UK extension to the EU–US Data Privacy Framework.

9. Your rights

Under the UK GDPR you can ask us for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict how we use it, object to our using it where we rely on legitimate interests, ask for it in a portable form, and withdraw any consent you have given.

Email info@viazo.co.uk and we will respond within one month. There is no charge. If your request concerns what a tour company has done with your data after we passed it to them, we will tell you who to ask and pass the request on.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk. We would rather you came to us first so we can put it right.

10. Cookies

We use as few as we can, and we split them into two kinds.

Strictly necessary, set without asking because the site cannot work without them: one that remembers you are signed in, one that remembers whether you are reading the site in English or Spanish, and one that remembers your answer to the cookie question itself.

Optional, and set only if you say yes: a Google cookie used to tell us that an advert led to a booking. We ask before setting it. Until you accept, the Google tag is not loaded and nothing is requested from Google at all; if you decline, it stays that way. Nothing about the site works differently either way, and we do not use cookies to follow you around other websites.

You can change your answer at any time using Cookie choices at the bottom of any page, and you can clear or block cookies in your browser. Blocking the sign-in cookie will stop you being able to sign in.

11. Children

Viazo is not intended for children, and we do not knowingly collect data about anyone under 16 except as part of a booking made by an adult — a child’s place on a tour, for instance. If you believe we hold a child’s data that we should not, tell us and we will remove it.

12. Changes

If we change this policy we will update the date at the top. Where a change materially affects you we will tell you, and we will never apply a new purpose to data we already hold without a lawful basis for doing so.