1. Introduction

At JCY Tour and Travel, your privacy matters to us. We are committed to handling your personal information responsibly and in accordance with applicable data protection laws.

This policy covers information collected through our website, booking forms, contact forms, and account registration — including sign-ups via Google, Facebook, or Microsoft.

2. Information We Collect

We collect information necessary to process your tour bookings and provide our services. This includes:

2.1 Information You Provide Directly

When you register, book a tour, or contact us, you may provide:

• Full name, email address, and phone number
• Passport or travel document details (for tour bookings)
• Travel dates, group size, nationality, and special requirements
• Account login credentials (if registering directly) or OAuth tokens (Google, Facebook, Microsoft)

2.2 Information Collected Automatically

When you browse our website, we may automatically collect:

• IP address and browser type
• Pages visited and time spent on the site
• Session data used to maintain your login and cart state
• Referral source (how you found our website)

3. How We Use Your Information

We use the information we collect solely to deliver our travel services, including:

• Processing tour bookings and sending booking confirmations
• Sending email verification codes and account-related notifications
• Notifying our team of new bookings and enquiries via Telegram
• Responding to enquiries submitted through our contact and custom tour forms
• Improving our website and services based on usage patterns

4. Information Sharing and Disclosure

We do not sell or rent your personal information. We only share it in the following limited circumstances:

4.1 With Your Consent

We share personal information with third-party travel partners (hotels, transport providers, local guides) only as necessary to fulfil your booked tour itinerary.

4.2 For Legal Reasons

We may disclose your information if required to do so by law, or in response to valid requests by public authorities, including:

• Compliance with applicable laws or court orders
• Enforcement of our Terms and Conditions
• Prevention of fraud or security threats
• Protection of the rights and safety of our staff, clients, or the public

5. Data Security

We take reasonable technical and organisational measures to protect your personal information, including:

• HTTPS encryption for all data transmitted through our website
• Session-based authentication with secure cookie settings and CSRF protection
• Access to personal data is restricted to authorised staff only

6. Your Rights and Choices

You have the following rights regarding your personal information:

• The right to access the personal data we hold about you
• The right to request correction of inaccurate information
• The right to request deletion of your account and associated data
• The right to withdraw consent for marketing communications at any time

7. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we do, we will update the effective date at the top of this page.

Continued use of our website or services after any update constitutes your acceptance of the revised policy.