Tours.ba is a marketplace for travel experiences in Bosnia and Herzegovina. You book on Tours.ba, and a named local operator delivers your day. This policy explains how we collect, use, share, and protect your personal data, and the choices you have.
GDPR and UK GDPR
Plain‑English summary
Your rights explained
Cookie controls
Marketplace transparency
We follow the EU GDPR and UK GDPR. If local consumer or privacy laws give you stronger rights, we honour those.
We collect only what we need to run the marketplace and support your trip.
You give us
We collect automatically
We receive from others
We do not need special category data. If you share access needs that reveal health information, we use them only to support your booking.
Purpose | Examples | Legal basis |
Provide the service | Create your account, process bookings, send confirmations | Contract |
Safety and support | Share meeting details with the Operator, handle changes and incidents | Contract, legitimate interests, vital interests in emergencies |
Payments and refunds | Take payment, issue refunds, prevent fraud | Contract, legitimate interests, legal obligation |
Service improvement | Fix errors, measure site performance | Legitimate interests |
Marketing | Send newsletters if you opt in, show on‑site recommendations | Consent for email, legitimate interests for on‑site suggestions |
Legal compliance | Keep records, handle disputes, respond to lawful requests | Legal obligation |
You can withdraw consent at any time. This does not affect processing done before withdrawal.
We share only what is necessary.
We do not sell personal data.
Our servers and partners may be in the EEA, the UK, and other countries. When we transfer data, we use approved safeguards such as Standard Contractual Clauses, UK IDTA or Addendum, and partner audits. You can ask for a copy of relevant safeguards.
We keep data only as long as needed.
When retention ends, we delete or anonymise the data.
Depending on your location, you may have the right to:
To act on your rights, email privacy@tours.ba. We respond within one month in most cases. You can also contact your local authority, for example [Your EEA authority] or the ICO in the UK.
We send service emails about your booking. You can opt in to our newsletter on forms that clearly say what you will receive. Every marketing email has an Unsubscribe link. Unsubscribing does not affect service emails.
We use essential cookies to make the site work, and optional cookies for analytics and marketing. You can manage consent in the banner and the Cookie policy at any time. Refusing optional cookies will not stop you from booking, but may limit features.
You must be at least 18 to book. Our content helps families plan, but the site is not directed at children. If you believe a child gave us data without consent, contact privacy@tours.ba and we will delete it.
We protect data with encryption in transit, access controls, and regular reviews. Only trained staff and trusted partners can access personal data for approved tasks. No online service is perfectly secure, so we encourage good hygiene such as unique passwords.
If we ever face a breach that risks your rights, we will inform you and the authorities as required by law.
We use automated checks to reduce fraud and abuse. These checks do not produce legal or similarly significant effects without human review.
We update this page when our services or the law changes. We post the new date at the top. If the changes are material, we will notify you by email or on the site.
