Privacy policy

1. Who we are

Gibraltar Guided Tours (“we”, “us” or “our”) operates this website and arranges the tours and experiences offered through it. The organisation responsible for deciding how and why your personal information is used (the data controller) is Calypso Tours Limited.

Our postal address is Cloister Building, Market Lane, Gibraltar, GX11 1AA. For privacy questions or to exercise your rights, email support@gibraltarguidedtours.com or write to this address, marked “Privacy”. You can also call +350 582 81000. We are a small tour operator and are not required to appoint a data protection officer; the privacy contact above handles all data-protection matters.

This notice covers visitors, people making enquiries, account holders, booking contacts and passengers. It explains our handling of information under the Gibraltar General Data Protection Regulation and Data Protection Act 2004. Other data-protection laws may also apply depending on the circumstances.

2. Information we collect

• Contact and account information: your name, email address, telephone number, account identifier, sign-in history and account status. Sign-in uses a code or link sent by email rather than a password. Checkout can create an account associated with your email.
• Booking information: your booking reference, tour and experience selections, dates, departure times, numbers of adults, children and infants, pricing tier, currency, amounts, booking status and check-in records.
• Payment information: transaction and checkout references, payment provider, amount, currency, payment and refund status, timestamps and information needed to investigate a failed payment or dispute.
• Correspondence: enquiries, support requests and booking communications, including records of delivery of service emails.
• Technical information: IP address, browser and device information, requested URLs, request identifiers, timestamps, authentication events and error or performance information.
• Preferences and usage: language, currency, saved cart and checkout details, and, when analytics is enabled, page visits and interactions associated with an analytics identifier.

We receive information directly from you, automatically from your browser, from the person booking for your party, and from payment providers confirming payments or refunds. Tour staff and experience providers may supply operational updates relating to your booking.

Our standard booking form records child and infant counts, rather than their names or dates of birth. Please do not send passport copies, full card details or sensitive medical information through ordinary email or booking enquiries.

3. Why we use information

We use information only for a defined purpose and an applicable lawful basis:

• Arranging and delivering your booking: handling enquiries, creating your booking, taking payment, issuing tickets, allocating capacity, checking passengers in, arranging selected experiences and processing changes or refunds. This is necessary to enter into or perform our contract with you.
• Accounts and service messages: authenticating you, showing your bookings and sending sign-in codes, tickets, reminders and booking updates. This supports our contract and our legitimate interests in providing secure, reliable customer service.
• Other passengers: where the booking contact supplies information about someone else, our legitimate interest is to organise and deliver that party’s tour safely and accurately.
• Security and support: preventing misuse and duplicate transactions, diagnosing failures, resolving complaints and protecting legal claims. Our legitimate interests are to protect customers and operate a dependable service.
• Records and legal requests: meeting applicable accounting, tax and other legal duties, and responding to lawful requests from authorities, on the basis of the relevant legal obligation.
• Website analytics: counting visits and seeing which pages and campaigns work, so we can improve the site. By default this happens without cookies or other storage on your device (sections 8 and 9), on the basis of our legitimate interest in running and improving the website.
• Advertising measurement: only if you accept advertising measurement — measuring our Meta (Facebook and Instagram) and Google advertising. You can withdraw this consent at any time.

Where we rely on legitimate interests, we must balance those interests against your rights. Where we rely on consent, you can withdraw it without affecting earlier lawful processing. Essential booking and contact information is needed to provide a booking; without it we may be unable to arrange the tour or take payment.

This notice is not a request for marketing consent. Booking or signing in does not, by itself, subscribe you to promotional messages. Any future marketing programme should explain its choices and provide an unsubscribe method separately.

4. Payments

Card payments are handled by the provider offered at checkout: SumUp (SumUp Limited and SumUp Payments Limited) through an embedded payment form, or Paylands, a payment platform operated by PayNoPain Solutions, S.L. in Spain, through its hosted payment page. The provider and its banking or payment partners process card details, authentication and fraud checks. Our booking database stores transaction records, not your full card number or card security code.

We exchange the booking or transaction reference, amount, currency and relevant customer identifiers with the payment provider, and receive payment, failure and refund results. The provider may also process information for its own regulatory and security purposes under its own privacy notice. Check the provider’s notice in the payment journey for those activities.

5. Who receives information

• Authorised staff, guides and drivers: information needed to manage bookings, contact the lead passenger, operate tours and validate tickets. Passenger manifests can include the lead name, email, phone number, booking reference and party counts.
• Selected experience providers: the lead contact’s name, email and phone number, booking reference, party counts, tour date and time, and chosen experience, so they can fulfil that part of your booking and contact you about it.
• Technical suppliers: Hetzner Online GmbH hosts the website and its database in Germany, and our transactional email (sign-in codes, tickets and booking updates) is sent through an email delivery service acting on our instructions.
• Payment providers: SumUp or Paylands (PayNoPain Solutions, S.L.) and relevant payment partners, as described above.
• Analytics and monitoring suppliers: PostHog for website analytics (without cookies unless you consent) and, where error monitoring is switched on, Sentry for error and performance monitoring.
• Meta Platforms: only if you accept advertising measurement, the Meta Pixel sends page views and completed purchases (amount and currency) to Meta to measure our advertising. For completed purchases our server also reports the purchase to Meta directly, including a hashed (one-way encoded) version of your email address, your IP address and browser/device details, so Meta can match the purchase to our advertising.
• Google: only if you accept advertising measurement, the Google tag measures advertising and completed purchases, including purchase amount, currency and an opaque transaction identifier.
• Professional advisers and authorities: where necessary for legal advice, accounting, disputes, protecting rights or complying with the law.

Recipients should receive only the information needed for their role. Suppliers acting on our instructions require appropriate data-protection arrangements; some payment and experience providers may act as separate controllers for their own activities.

6. International processing

Some suppliers process information outside Gibraltar:

• Website and database: Hetzner, in Germany (European Economic Area).
• Error monitoring: Sentry, in the United States, where error monitoring is switched on.
• Analytics: PostHog, in the United States.
• Advertising measurement: Meta and Google, which may process data in the United States and elsewhere. This only happens if you accept marketing cookies.
• Payments: Paylands (PayNoPain Solutions, S.L., Spain, European Economic Area) and SumUp (United Kingdom and European Economic Area), together with the card networks and banks involved in each payment.
• Email delivery: our email delivery service, which may process messages in the European Economic Area or the United States.

Where information leaves Gibraltar and the European Economic Area, we rely on an adequacy decision where one applies (for example for the United Kingdom) or on the supplier’s standard contractual clauses and equivalent safeguards. You can request a copy of the relevant safeguard through the privacy contact above.

7. How long information is kept

Retention must reflect the purpose of the information, the length of the customer relationship, applicable accounting and tax duties, and the time needed to resolve disputes or establish legal claims. Cancelling a booking or signing out does not automatically erase its records.

• Sign-in codes: valid for 10 minutes; expired authentication-code records are deleted automatically by the database.
• Sessions: use a 30-day expiry that can be renewed with activity. Expired database sessions are deleted automatically; physical removal need not happen at the exact expiry instant.
• Accounts, bookings, payments and correspondence: kept for six years after the booking or your last interaction with us, so we can meet accounting and tax duties and deal with any dispute; this includes unsuccessful and cancelled bookings. These records are not deleted automatically: we review and delete them manually once the period has passed, and accounts with no bookings can be deleted on request at any time.
• Security logs, diagnostic events and analytics: kept by each supplier for the limited period set by that supplier’s retention policy and then deleted or aggregated.
• Backups and copies held by operational providers: overwritten on a rolling cycle, with access restricted to authorised technical staff; copies may be kept longer only where the law requires it.

Browser storage has separate lifetimes, described below. Expiry of a browser item does not delete the corresponding booking or payment record.

8. Cookies and browser storage

Cookies are small values sent with website requests. Local storage stays in your browser between visits; session storage normally lasts for the browser tab’s session. This site uses these technologies for the following purposes:

Sign-in — gi_session

A signed, HTTP-only cookie used to authenticate you, with a 30-day lifetime. Session expiry can be renewed through activity. Signing out ends the current sign-in.

Language and currency — ggt_lang and ggt_ccy

Preference cookies saved for up to 365 days when your choices are updated.

Cart — ggt_cart

Local storage holding your tour, party and experience selections. It has no automatic time limit and remains until the cart is cleared, a successful checkout clears it or you remove browser data.

Checkout details — ggt_checkout_contact

Local storage used to prefill your name, email and phone number. New entries have a 30-day expiry checked when read and are cleared after a successful booking. Older entries without an expiry timestamp can remain until overwritten or cleared.

Duplicate-payment protection — ggt_checkout_idem

Session storage holding a checkout identifier, tied to the contents of your cart, to prevent the same checkout being created twice.

Your cookie choice — ggt_consent_v1

Local storage remembering your analytics-cookie choice until you change it or clear site data. Marketing has a separate choice below.

Marketing choice — ggt_marketing_consent_v1

A separate, versioned advertising choice, valid for up to 180 days. An earlier combined cookie choice does not opt you into this advertising measurement.

Purchase counting — ggt_meta_purchases_v1 and ggt_google_ads_purchases_v1

With marketing permission, local storage keeps opaque event identifiers to reduce duplicate purchase counting across reloads and tabs. Entries expire after 30 days when read; no contact details or booking-access credentials are stored in this list. Blocking storage reduces duplicate protection.

Payment-return recovery

The current browser history entry can retain the booking-access details needed to recover a payment return after refresh. We remove them from the visible confirmation address before advertising tracking can start. Keep booking-access links and shared-device history private.

Checkout measurement — ggt_meta_checkout_attempt_v1 and ggt_meta_checkouts_v1

With marketing permission, a session identifier ties checkout measurement to the current cart, while local event receipts reduce repeat counting for up to 30 days when read. This is separate from payment duplicate protection and is cleared or replaced as the checkout completes or the cart changes.

Analytics — PostHog (only with your consent)

If you accept analytics cookies, PostHog stores an identifier in a cookie and local storage named ph_…_posthog for up to 365 days, so repeat visits can be recognised. Without your consent PostHog stores nothing on your device (section 9).

Campaign attribution — ggt_campaign_attribution_v1

Only with advertising measurement permission, we keep the first and latest valid campaign codes in local storage for up to 30 days per touch, checked when read. This works even when Meta is disabled. We do not save full landing URLs, referrers or advertising click IDs in this record. Withdrawal clears this browser record. At checkout, an optional snapshot is saved with the booking for staff campaign reporting and retained under our booking-record retention policy; clearing browser storage does not erase an existing booking snapshot.

Advertising — Meta Pixel _fbp, _fbc (only with your consent)

If you separately accept advertising measurement and it is enabled, the Meta Pixel sets these cookies for up to 90 days to measure our Meta advertising.

Advertising — Google tag _gcl_* (only with your consent)

If you accept advertising measurement and it is enabled, Google may use cookies and advertising click identifiers to measure purchases resulting from our Google advertising.

We ask before setting any analytics or advertising cookies. A banner offers “Accept all” and “Reject all” equally, with a “Change settings” option for separate analytics and advertising measurement choices; you can change your choice at any time with “Cookie settings” at the foot of every page. Withdrawing consent stops the tracking and deletes the analytics and advertising cookies we are able to remove. If your browser sends a Do Not Track or Global Privacy Control signal, we do not load analytics at all.

You can delete or block cookies and site storage through your browser settings. Blocking sign-in storage can prevent account access; clearing cart or checkout storage removes saved selections and prefilling. Clear site data after using a shared device. Payment forms and hosted payment pages may use their own storage for payment security; consult their notices.

9. Analytics and diagnostics

PostHog records page views: the page address (with everything after the “?” removed, except campaign “utm_” tags), the referring page, approximate location derived from your IP address, and browser and device type. When a booking is paid it records a “booking paid” event with the amount and currency only. It does not build a profile of you. Only if you accept analytics cookies, and only on our public information pages (never on checkout, booking, sign-in, confirmation or staff pages), PostHog also records anonymised click and scroll positions (heatmaps) and a replay of your session on the page, in which everything you type into a form is masked.

By default PostHog works without cookies: it counts visits using an identifier that PostHog’s servers derive each day from your IP address and browser details, so a returning visitor is counted again on a new day. Only if you accept analytics cookies does it store an identifier on your device (section 8).

When enabled and with your separate marketing permission, the Meta Pixel measures permitted public page views, tour views, successful cart additions, checkout starts and newly paid bookings. It receives public product identifiers, quantities, amounts, currencies and opaque purchase-event identifiers. Page addresses are restricted; campaign free text is removed and validated Meta or Google ad-click identifiers may be retained for attribution. Meta may receive your IP address, browser/device information, referring page and advertising identifiers through its browser library. We exclude staff and account pages and do not send booking references, access credentials or payment-provider identifiers. Purchases are reported only with the permission recorded at checkout. Browser blocking or a missed return can prevent browser reporting. Google Ads receives confirmed purchase amounts, currencies and opaque transaction identifiers when enabled and with your advertising permission at checkout and reporting. Google may receive your IP address, browser/device information and advertising identifiers through its tag. For purchases made with advertising permission, our server also sends the purchase to Meta through its Conversions API: the amount, currency and time, the same opaque purchase identifier as the browser event, a hashed email address, your IP address, browser/device details and any Meta advertising cookie identifiers. We keep the IP address and device details only until the report is delivered, and for no more than a day. Withdrawing consent stops new application tracking; it cannot recall data already sent or requests already in flight. Sentry may receive browser or server errors and sampled performance traces. Request logs can include IP addresses, URLs and identifiers; checkout diagnostic logs may also contain contact details.

10. Keeping information secure

The application uses access permissions, expiring sign-in codes and signed session cookies to restrict account access. Payment details are entered into payment-provider forms. We must also maintain appropriate organisational and technical safeguards for our systems and suppliers; no internet service can guarantee absolute security.

Keep sign-in codes, sign-in links and ticket QR codes private. If you believe your account or booking information has been accessed improperly, contact us promptly using the privacy contact above.

11. Your rights

Subject to applicable conditions and exemptions, you can request access, correction, erasure, restriction or a portable copy of your personal information. You can object to processing based on legitimate interests and to direct marketing, and withdraw consent where processing relies on it.

Send requests to the privacy contact in section 1. There is no self-service tool for these requests: a member of our staff handles each one by hand, and we will confirm receipt. We may ask for proportionate identity checks. We normally respond within one month; where a lawful extension is needed, we will explain it. Requests are normally free. Some records may need to be retained to meet legal duties or deal with claims, for example payment records for a booking you have taken.

12. Automated booking processes

The site automatically checks availability, allocates a booking to a suitable trip, expires unpaid reservations and validates payment results. These processes support the booking service. Payment providers may carry out their own fraud screening. If an automated result appears incorrect or prevents you from booking, contact us for assistance and review.

13. Children and other passengers

An adult should arrange bookings involving children. If you provide information about another passenger, make sure you are entitled to do so and share this notice with them or their parent or guardian. Provide only what is needed for the booking. If an accessibility arrangement requires sensitive information, contact us first so we can explain the necessary information, lawful basis, recipients and handling arrangements.

14. Other websites

Links to social networks, experience providers and other external sites take you to services with their own privacy practices. Their notices apply to information you provide directly to them. Our use of an external link does not mean we control that service.

15. Questions and complaints

You can contact us about any concern. You may also complain directly to the Gibraltar Regulatory Authority, Gibraltar’s data-protection regulator, without first contacting us. Other competent supervisory authorities may also be available under applicable law.

16. Changes to this notice

We will update this page when our handling of information changes and show the revised date. Material changes will be brought to your attention where appropriate. Any new processing that requires consent will need a separate choice; updating this notice does not supply that consent.

Return to the homepage