Privacy Policy

At Z.M. The Project Travel and Tour Ltd, we respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, store and protect your information when you visit our website, contact us, request transfer services or make a booking through our website.

1. Data Controller

The data controller responsible for your personal data is:

• Company: Z.M. The Project Travel and Tour Ltd
• Phone: +357 95585582
• Email: [email protected]
• Address: Panteli Mixanikou 10, Office 3, 8046, Paphos, Cyprus

2. What Personal Data We Collect

Some personal data is necessary for us to respond to requests, process bookings, arrange transfers and deliver the services you ask for. If you do not provide mandatory information requested in a form or booking flow, we may be unable to process your request or complete the relevant service.

a. Information submitted through contact or private-tour forms

When you send an enquiry, we may collect:

• Full name
• Email address
• Telephone number
• The type of enquiry, preferred travel date, group size and pickup area where relevant
• Tour interests, accessibility needs and other details included in your message
• The date, time and version of the privacy notice you acknowledged
• Any other information you choose to include in your message

b. Booking information submitted through Bókun

For online bookings of tours made through the embedded Bókun booking system, booking-related personal data may be collected and processed through that platform, such as:

• Name
• Email address
• Telephone number
• Booking details
• Participant details
• Travel or service preferences
• Payment-related booking information submitted through the booking flow

c. Security and first-party conversion data

We process limited technical data to protect the forms and understand whether the website produces genuine enquiries. This may include:

• A one-way cryptographic hash derived from an IP address for short-term anti-abuse rate limiting; we do not store the raw IP address in the enquiry database
• Cloudflare Turnstile verification results used to distinguish legitimate visitors from automated spam
• The page path, link context and time of a WhatsApp click; we do not store the WhatsApp message, full WhatsApp URL or a persistent visitor identifier for this count
• The page path and time of a form submission
• Operational email-delivery and application error logs that are designed not to contain form-message content or account secrets

d. Consent-based analytics and advertising data

If you select “Accept All” in the website privacy notice, Google Analytics 4 may process information about pages viewed, approximate location, device and browser characteristics, referrals and interactions such as an enquiry submission or WhatsApp click. Google Ads conversion measurement may additionally record that a visit which began from one of our adverts led to an enquiry or booking. We do not send names, email addresses, phone numbers, message text or submission reference numbers to Google.

If you choose “Use Necessary Only”, no analytics or advertising cookie is set and no advertising identifier is read. Our Google tag operates under Consent Mode v2 and remains in a denied state, in which Google receives only an anonymous, cookieless record that a page was viewed. Full detail is in our Cookie Policy.

3. How We Use Your Personal Data

We use personal data for the following purposes:

• To respond to inquiries and requests submitted through our website
• To communicate with you about transfer services or other requested services
• To manage and facilitate tour bookings
• To provide customer support
• To understand which pages and contact actions are useful, using first-party conversion counts and, only with your consent, Google Analytics
• To measure which of our adverts lead to an enquiry or booking, only with your consent, using Google Ads conversion measurement
• To maintain website security and prevent misuse
• To comply with legal, tax, accounting or regulatory obligations
• To establish, exercise or defend legal claims where necessary

4. Legal Bases for Processing

We process your personal data on one or more of the following legal bases:

• Performance of a contract: where processing is necessary to provide requested services, handle bookings, or respond to service inquiries
• Legitimate interests: for the proper operation, improvement and security of our website and services
• Legal obligation: where we are required to retain or disclose data under applicable law
• Consent: for Google Analytics, Google Ads conversion measurement, and any future optional marketing communications

Where we rely on legitimate interests, these may include operating and administering the website, responding to customer communications, preventing misuse, maintaining security, improving our services, handling internal administration and protecting or defending legal claims.

The required form checkbox confirms that you have read this Privacy Policy. It is not consent to receive marketing. We use the details needed to answer a requested service enquiry primarily to take steps at your request before a possible contract and, where relevant, for our legitimate interest in handling customer communications securely.

5. Bookings Through Bókun

Our website includes the Bókun booking system for online bookings of our premade tours. When you submit booking information through Bókun, your personal data may be processed through that third-party booking platform in accordance with its own privacy practices and terms.

We recommend that users also review Bókun's own Privacy Policy before completing a booking through the booking interface embedded on our website.

6. Sharing of Personal Data

We do not sell your personal data.

We may share your personal data only where necessary with:

• Booking and reservation platform providers, including Bókun
• Cloudflare, which provides website hosting, security, Turnstile, database storage and access controls for the secure dashboard
• SiteGround, which provides the mailbox and email-delivery infrastructure used for enquiry notifications
• Google, for Analytics and Ads conversion measurement, but only after you accept them in the privacy notice
• IT and website maintenance partners
• Payment or booking-related service providers used within the booking flow
• Professional advisers, accountants or legal advisers where necessary
• Public authorities, regulators or law enforcement authorities where required by law

7. International Transfers

Some of the service providers we use, including third-party booking or technology providers, may process personal data outside Cyprus or outside the European Economic Area.

Where such transfers take place, we take reasonable steps to ensure that appropriate safeguards are in place in accordance with applicable data protection law.

Depending on the destination and provider, these safeguards may include an adequacy decision issued by the European Commission, the European Commission's Standard Contractual Clauses or another lawful transfer mechanism recognised under the GDPR. You may contact us if you would like more information about the safeguards used in a particular case.

8. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, including for legal, tax, accounting, dispute resolution and regulatory purposes.

In general:

• Contact form inquiries are retained for as long as reasonably necessary to handle the request and follow-up communication
• Service and booking-related records may be retained for longer where necessary for contractual, operational, accounting or legal reasons
• Anti-abuse, conversion and operational logs are retained for a limited period appropriate to security, measurement and troubleshooting, unless a longer period is required for legal or security reasons

When deciding how long to retain personal data, we consider the nature and sensitivity of the information, the purpose for which it was collected, whether an ongoing customer relationship exists, applicable legal and accounting obligations, limitation periods and whether retention is necessary to resolve disputes or enforce our terms.

We are finalising documented deletion schedules for the new enquiry dashboard. You may contact us to ask how long a particular record is expected to be retained or to request deletion where the law permits.

9. Cookies and Similar Technologies

The website stores a necessary local preference so it can remember whether you accepted or declined analytics and advertising measurement. No analytics or advertising cookie is set, and no advertising identifier is read, unless you select “Accept All”. You can change that choice at any time using “Cookie Settings” in the footer.

Cloudflare Turnstile is loaded on enquiry forms as a security service. Bókun and Google Maps may use their own cookies or similar technologies when their embedded features are loaded.

For more detailed information about the cookies and similar technologies used on the website, including how users can manage their preferences, please review our Cookie Policy.

10. Data Security

We use measures including encrypted connections, server-side input validation, spam screening, rate limiting, restricted database access, a Cloudflare Access-protected staff dashboard and secret values stored outside the public source code.

However, while we take reasonable steps to protect your data, no method of transmission over the internet or method of electronic storage is completely secure.

We do not currently use your personal data for solely automated decision-making, including profiling, that produces legal effects or similarly significant effects on you.

11. Your Rights

Under applicable data protection law, you may have the right to:

• Request access to your personal data
• Request correction of inaccurate or incomplete data
• Request deletion of your personal data
• Request restriction of processing
• Object to certain processing activities
• Request data portability, where applicable
• Withdraw consent at any time, where processing is based on consent
• Lodge a complaint with a competent supervisory authority

Where processing is based on consent, withdrawing consent does not affect the lawfulness of processing carried out before that withdrawal. To exercise your rights, please contact us using the details in the Contact Us section below.

12. Supervisory Authority

If you believe that your personal data has been processed unlawfully, you have the right to lodge a complaint with the competent supervisory authority in Cyprus:

• Authority: Office of the Commissioner for Personal Data Protection
• Website: www.dataprotection.gov.cy
• Phone: +357 22 818456
• Email: [email protected]
• Address: Kypranoros 15, 1061 Nicosia, Cyprus
• Postal address: P.O. Box 23378, 1682 Nicosia, Cyprus

13. Third-Party Websites

Our website may contain links to third-party websites or services, including social media platforms and external booking-related services. We are not responsible for the privacy practices, content or security of such third-party websites.

We encourage users to review the privacy policies of those third parties before submitting personal data.

14. Children's Privacy

Our website and services are not specifically directed at children. We do not knowingly collect personal data from children without appropriate legal basis or parental involvement where required.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time in order to reflect legal, technical or operational changes. Any updated version will be posted on this page with the revised “Last Updated” date.

16. Contact Us

If you have any questions about this Privacy Policy or about how we process your personal data, you may contact us using the details below:

• Company: Z.M. The Project Travel and Tour Ltd
• Email: [email protected]
• Phone: +357 95585582
• Address: Panteli Mixanikou 10, Office 3, 8046, Paphos, Cyprus

This Privacy Policy is provided for informational purposes and should be reviewed periodically to ensure continued compliance with applicable legal and operational requirements.