Privacy Policy

This page explains in plain words what personal data testtour4.toursvn.com (TESTTOUR4) collects, why, who we share it with, how long we keep it and what your rights are. It follows the EU General Data Protection Regulation (GDPR), the strictest standard, which we apply to every guest, and the law of the provider's country. Cookies are covered in a separate Cookie Policy.

1. Who is responsible for your data

TESTTOUR4, website testtour4.toursvn.com. Office: . For any data question write to tieuvienvien102@gmail.com or WhatsApp .

2. What data we collect

• When you book a tour or buy a ticket: name, phone / WhatsApp, email, pick-up point (hotel or address), number of adults, children and infants, selected options and coach seats, your comments, payment amount and status. We never see or store your card details — you enter them on the bank’s page.
• Documents for certain tours: passport details or a passport photo and accommodation details — only for multi-day tours and trips where hotels, carriers or the law require them.
• Client account: phone number and a secure login link, your booking history.
• Messages: WhatsApp, Telegram, email and phone conversations if you contact us.
• Reviews: name, text and photos if you leave a review.
• Newsletter: your email if you subscribe to news and new tours.
• Technical data: IP address, browser type and visit time in server logs, for security and troubleshooting. Cookies are described in the Cookie Policy.
• From partners: if a partner (for example, a travel agent) books for you, they pass us the data needed for the trip.

3. Why and on what legal basis

• To run the tour or issue the ticket, send the pick-up time, contact you about the trip and assign coach seats — performance of our contract with you (Art. 6(1)(b) GDPR).
• To take payments, issue receipts and keep accounting and tax records — legal obligation (Art. 6(1)(c)).
• To pass passport details to a hotel, carrier or for guest registration — contract and legal requirements (Art. 6(1)(b) and (c)).
• To protect the site and payments from fraud and credit bookings to partners — our legitimate interest (Art. 6(1)(f)).
• To send the newsletter, measure visits and publish your review — only with your consent (Art. 6(1)(a)). You can withdraw it at any time.

4. Who we share data with

• Guides, drivers and office staff — group list, phone and pick-up point, to run the trip.
• Hotels, carriers, parks and museums that are part of your trip. Theme park e-tickets are issued through Experticket.
• The partner you booked through — only for your booking.
• Payment services: Redsys and BBVA bank (card payments), Amelie (QR / SBP payments in roubles). They process payment data on their own responsibility.
• Technical providers: Amazon Web Services (website server), Bunny.net (delivery of site images and files, EU), Google (backups on Google Drive, guides’ calendars, the map on the contact page — with consent), Telegram and WhatsApp (internal notifications to staff and chats if you write to us there), Yandex (Metrica — only with consent).
• Public authorities — only when the law requires it.
• We do not sell data or share it for third-party advertising.

5. Transfers outside the EU

The website server is hosted by Amazon Web Services in Singapore; the transfer is protected by the European Commission’s standard contractual clauses. Google and WhatsApp (Meta) operate under the EU–US Data Privacy Framework or standard clauses. Yandex.Metrica (Russia) is enabled only with your explicit consent (Art. 49(1)(a) GDPR). If you choose to pay in roubles via Amelie, the payment data goes to that service because it is necessary for the payment (Art. 49(1)(b)).

6. How long we keep data

• Bookings, payments and receipts — 6 years, as required by accounting and tax rules.
• Passports and tour documents — deleted automatically 30 days after the trip ends.
• Messages — as long as needed for the trip and any follow-up questions.
• Newsletter subscription — until you unsubscribe. Every email has an “unsubscribe” link.
• Server logs — 14 days. Database backups — the latest 14 copies.
• Cookies — see the Cookie Policy.

7. Your rights

You can find out what data we hold about you, correct it, delete it, restrict processing, receive it in a portable format, object to processing and withdraw consent (this does not affect processing before withdrawal). Write to tieuvienvien102@gmail.com — we reply within one month. Data we must keep by law (such as receipts) will be deleted once the mandatory period ends. If you believe your rights have been infringed, you can complain to the data protection authority of your country or of the provider's country.

8. How we protect data

The site works over HTTPS only. Staff access is role-based: a guide sees only their own group. Passports are kept in a closed storage area, and internal files are not reachable from the internet. We make regular backups.

9. Children

Children’s data (name or age for a ticket or coach seat) is provided by parents or accompanying adults. Children under 14 should not submit their data on the site without a parent.

10. Automated decisions

We do not make automated decisions about you or create profiles.

11. Changes

If the data, purposes or providers change, we will update this page and the date at the top.