Privacy Policy

The controller of your personal data is EMYR TOURS LTD, based in Kraków, Poland. For any question about your data or to exercise your rights, contact us:

• E-mail: emyrtours@gmail.com
• Phone: +48 500 786 781

• Contact details: your name, e-mail address and phone or WhatsApp number.
• Booking details: pickup and destination locations, dates and times, your itinerary, the number of passengers and luggage, your vehicle choice, pickup and drop-off points and any special requests. For car rental, also your driver age range, the countries you plan to visit, your chosen options and, if you give it, your flight number.
• Account details: your e-mail address and name. If you sign in with Google, Apple or Facebook, we receive your name and e-mail address from that provider.
• Messages: what you send us through the contact form, by e-mail or on WhatsApp.
• Newsletter: your e-mail address, if you subscribe.
• Payment details: payments are handled by Stripe. We receive confirmation of the payment and its amount, but never your full card details.
• Technical data: your IP address and basic browser information, which our hosting provider records in server logs to keep the website secure.

• To answer your requests, prepare quotes, and provide and manage your bookings — necessary to take steps at your request and to perform our contract with you (Article 6(1)(b) GDPR).
• To run your customer account — performance of a contract (Article 6(1)(b) GDPR).
• To keep accounting and tax records — compliance with our legal obligations (Article 6(1)(c) GDPR).
• To answer messages, handle complaints, keep the website secure and establish or defend legal claims — our legitimate interests (Article 6(1)(f) GDPR).
• To send our newsletter — your consent (Article 6(1)(a) GDPR), which you can withdraw at any time.

We share your data only when needed for the purposes above:

• the drivers and partners who carry out your tour, transfer or rental;
• our service providers, who process data on our behalf: our website hosting provider, Resend (sending e-mails) and Stripe (processing payments);
• Google, Apple or Facebook, only if you choose to sign in with them;
• WhatsApp (Meta), if you contact us there;
• public authorities, when the law requires it.

We do not sell your personal data.

Some of our service providers, such as Stripe and Resend, may process data outside the European Economic Area, including in the United States. Where this happens, the transfer is protected by an adequacy decision of the European Commission (such as the EU-U.S. Data Privacy Framework) or by the European Commission's standard contractual clauses.

• Booking and customer data: for as long as we provide the service, then for as long as tax and accounting law requires (in Poland, generally 5 years from the end of the year of the transaction) and for the limitation period of any possible claims.
• Unfinished booking details saved while you confirm your e-mail address: deleted after 24 hours.
• Messages: for as long as needed to deal with them, then for the limitation period of any possible claims.
• Newsletter: until you unsubscribe.
• Customer account: until you ask us to delete it.

You have the right to:

• access your data and receive a copy of it;
• have inaccurate data corrected;
• have your data erased, or its use restricted;
• receive your data in a portable format;
• object to processing based on our legitimate interests;
• withdraw your consent at any time, without affecting processing that took place before.

To use any of these rights, e-mail us at emyrtours@gmail.com. To unsubscribe from the newsletter, e-mail us and we will remove you.

You also have the right to lodge a complaint with the Polish data protection authority: President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl — or with the data protection authority in your own country.

Giving us your data is voluntary, but we cannot prepare a quote or carry out a booking without the details the booking form asks for. Subscribing to the newsletter is entirely optional.

We do not make decisions about you based solely on automated processing, and we do not profile you.

Our website uses only cookies that are strictly necessary for it to work. We do not use analytics or advertising cookies.

• NEXT_LOCALE — remembers the language you chose. Kept for 1 year.
• next-auth.session-token — keeps you signed in to your account. Expires after 8 hours.
• next-auth.csrf-token — protects sign-in forms against misuse. Deleted when you close the browser.
• next-auth.callback-url — returns you to the right page after signing in. Deleted when you close the browser.

On the live website the sign-in cookies carry a __Secure- or __Host- prefix. Because these cookies are strictly necessary, they do not require your consent. You can block or delete them in your browser settings, but signing in will then not work.

If you choose to sign in with Google, Apple or Facebook, that provider may set its own cookies, as described in its own privacy policy.

We may update this Privacy Policy when our services or the law change. The current version is always published on this page, with the date of the last update at the top.

This policy is available in English and Arabic. If the two versions differ, the English version prevails.