Privacy Policy

There is only one thing we put above customer experience: privacy. This page explains how we collect, use, and protect your personal information when you use our website. If you have any enquiries or wish to access, amend or delete your personal data, please contact us via email: info@keytoursgibraltar.com

This Privacy Policy explains how Key Tours ("we", "us" or "our") is committed to protecting and respecting your personal information and your privacy.

This privacy policy describes how we collect, store and use personal information through our website. This privacy policy also sets out your rights in relation to the personal information which we hold about you.

Please read this privacy policy carefully to understand our practices regarding your personal information and how we will treat it. By using our website and services, you are accepting and consenting to the practices described in this privacy policy.

What do we collect?

We use cookies and third-party analytics tools (e.g., Google Analytics) to understand user behaviour and improve our services. You can manage cookie settings in your browser.

We do not collect sensitive information or information from children under 18. We do not knowingly collect personal data from minors.

We process your information to administer and improve our services, communicate with you, organise payment for our services, for security and fraud prevention, and to comply with the law. We may also process your information for other purposes with your consent.

What information do we collect?

We collect the following:

Full name
Email address
Phone number
Country of residence
Booking details (e.g, tour dates, group size, preferences)
Payment information (processed securely via third-party providers)
Accessibility needs
Marketing data (including your preferences in receiving marketing from us)

We may also use software tools to measure and collect session information, including page response times, length of visits to certain pages, page interaction information, and methods used to browse away from the page to understand the effect of our marketing. This data is not used to build a personal profile. As such, we may also collect:

Internet protocol (IP) address
Browser type and version
Time zone and location settings
Browser plug-in types and versions
Operating system and platform

This website contains links to third-party platforms. We are not in any way responsible for the data collection or usage practices of those platforms.

Although we do not use automatically collected visitor data to build a personal profile on you or identify you personally, Google, which provides the analytics service that collects the data, will do this. If you are logged into a Google account on your device, it will associate your data with the identity details that you have given to Google. What is done with that data will depend on the preferences you have expressed in the privacy settings of your Google account. If you are not logged into a Google account, the data will be associated with a unique identifier given to your browser or device.

For further details about how Google uses your data, please see Google's privacy policy and this statement about Google Analytics Privacy.

Why do we collect this information?

We collect this information to allow us to:

Process tour bookings
Communicate with you about your itinerary
Send updates, promotions, and travel tips (with your consent)
Improve our website and service
Comply with applicable laws and regulations

Collected information will not be sold at any point or used for any purposes other then those stated above.

Certain aspects of collected information may be shared with our service partners and third-party vendors who perform services for us or on our behalf and require access to such information to do that work.

All our partners commit to protecting the data they hold on our behalf. The categories of third parties we may share personal information with are as follows:

Stripe (Our payment processor used to allow us to process tour bookings)
Wix.com (Our booking management system and website host)

Legal grounds for collection and processing:

The General Data Protection Regulation (GDPR) requires us to explain the valid legal bases we rely on in order to process your personal information. These are:

Consent:
We may process your information if you have given us permission (i.e. consent) to use your personal information for a specific purpose. You can withdraw your consent at any time.

Performance of a contract:
We may process your personal information when we believe it is necessary to fulfil our contractual obligations to you, including providing our services or at your request prior to entering into a contract with you.

Legitimate interests:
We may process your information when we believe it is reasonably necessary to achieve our legitimate business interests and those interests do not outweigh your interests and fundamental rights and freedoms. For example, we may process your personal information for some of the purposes described in order to:
Analyse how our services are used so we can improve them to engage and retain users
Evaluate our marketing activities

Legal obligations:
We may process your information where we believe it is necessary for compliance with our legal obligations, such as to cooperate with a law enforcement body or regulatory agency, exercise or defend our legal rights, or disclose your information as evidence in litigation in which we are involved.

Vital interests:
We may process your information where we believe it is necessary to protect your vital interests or the vital interests of a third party, such as situations involving potential threats to the safety of any person.

Your data rights:

Within the European Economic Area (EEA) and the United Kingdom (UK), you have certain rights under applicable data protection laws. These may include the right (i) to request access and obtain a copy of your personal information, (ii) to request rectification or erasure; (iii) to restrict the processing of your personal information; and (iv) if applicable, to data portability. In certain circumstances, you may also have the right to object to the processing of your personal information. You can make such a request by emailing us at info@keytoursgibraltar.com. We will consider and act upon any request in accordance with applicable data protection laws.

If you are located in the UK and you believe we are unlawfully processing your personal information, you also have the right to complain to the Information Commissioner's Office. You can find their contact details here: https://ico.org.uk/make-a-complaint/.

If you are located in the EU and want to make a complaint, see this list of European Data Protection Supervisors.

If you are located in Switzerland, here are the contact details of the Data Protection Commissioner.

Withdrawing your consent: If we are relying on your consent to process your personal information, you have the right to withdraw your consent at any time. You can withdraw your consent at any time by contacting us via info@keytoursgibraltar.com
However, please note that this will not affect the lawfulness of the processing before its withdrawal, nor will it affect the processing of your personal information where there are lawful grounds other than consent.

Your data storage:

Our website is hosted on the Wix.com platform. They provide us with the online tools that allows us to sell our services to you. Your data may be stored through Wix.com’s data storage, databases and the general Wix.com applications. They store your data on secure servers behind a firewall.

All direct payment gateways offered by Wix.com and used by our company adhere to the standards set by PCI-DSS as managed by the PCI Security Standards Council, which is a joint effort of brands like Visa, MasterCard, American Express and Discover. PCI-DSS requirements help ensure the secure handling of credit card information by our store and its service providers.

We are legally required to keep data accurate. If there is a change to any of your data since your last visit, you can contact us at info@keytoursgibraltar.com to request amendments to your information.

In the event of a data breach, we will notify you within 72 hours if we hold your personal data.

Our policy may change periodically. It was last updated on the 16/08/25.