Privacy policy — Stand-by Tours

Who we are

This Privacy Policy is issued by LG Project Pond Ventures Ltd. (registration HE441622, VAT CY10441622A), a company registered in the Republic of Cyprus, trading as "Stand-by Tours" ("we," "us," "our," "SBT"). We are the data controller for the personal data described in this policy — the entity responsible for deciding how and why it's processed.

Stand-by Tours is a marketplace that connects travelers with independent tour and activity operators ("Operators" or "Suppliers"). We act as a disclosed booking agent for these Operators — see our Terms of Service for the full explanation. Because of that role, some of the data described below is shared with the Operator running your specific tour, so they can actually deliver the experience you booked — see "Who we share data with" below.

The data we collect

We collect different data depending on how you use the platform:

Account data

Name, email address, and password (or your Google account identifier, if you sign up with Google) when you create a customer, supplier, or admin account.

Booking data

Full name, email, phone number, and — only when the specific Operator's product requires it (for example, an age-restricted wine tour) — date of birth, plus any other information a specific tour's booking form asks for (such as participant names or dietary/accessibility notes you choose to provide). Guest checkout is supported, so you don't need an account to book.

Payment data

Payments are processed by Stripe. We never see or store your full card number — Stripe handles that directly and shares only what we need to confirm and manage your booking (such as a payment reference and the amount charged).

Account preferences

Your chosen display currency and language, and, if you have a customer account, your notification opt-ins (such as deal alerts or marketing updates) — all changeable at any time from your account settings.

Supplier & business data

If you register as a supplier, we additionally collect business details (business name, contact person, registered country), tax identification, payout bank details (IBAN and related bank information), and any documents you upload for verification (such as insurance or a business license) — used only to onboard and pay you, and visible only to you and SBT admin, never to customers.

Technical & usage data

Standard technical data such as your IP address, browser type, and pages visited — collected via cookies and similar technologies. See our Cookie Policy for the full breakdown of what we use and why.

Why we use your data

We process personal data for the following purposes:

To perform your booking: creating and confirming your reservation with the relevant Operator, processing payment, and sending you a booking confirmation and voucher.
To run your account: authentication, remembering your preferences, and letting you view your booking history and leave reviews.
To communicate with you: transactional messages about your booking (confirmations, changes, cancellations, refunds), account security notices (such as a password change), and — only if you've opted in — deal alerts or marketing updates.
To onboard and pay suppliers: verifying a supplier's identity and business documents, and processing payouts.
To keep the platform safe: detecting fraud, abuse, or attempts to manipulate stand-by inventory, and enforcing our Terms of Service.
To meet our legal obligations: including tax, accounting, and record-keeping requirements under Cyprus and EU law.

Our legal basis for most of this processing is that it's necessary to perform the contract with you (i.e. to actually deliver the booking service you've asked for), or to comply with a legal obligation. Marketing communications and non-essential cookies are based on your consent, which you can withdraw at any time.

Who we share data with

We don't sell your personal data. We share it only where necessary, with:

The Operator running your tour — since we act as a disclosed booking agent, the Operator you book with needs your booking details (name, contact details, and any product-specific information such as date of birth or dietary notes) to actually deliver the experience and manage their own booking system.
Bókun — our reservation and inventory management provider, used to create and manage bookings on behalf of Operators who use it.
Stripe — our payment processor, which handles your payment details directly.
Supabase — our database, authentication, and file-storage provider, which hosts the platform's underlying infrastructure.
Resend — our transactional email provider, used to send booking confirmations, account, and security emails.
Google Cloud Translation — if you use the in-page language switcher, the page text being translated is sent to Google for that purpose. See our Cookie Policy for more detail.
ipwho.is — used to resolve your IP address to a country, so we can default your display currency to something relevant without asking. This only runs if you haven't already chosen a currency yourself.
We may also disclose data where required by law, to protect our rights or the safety of others, or in connection with a merger, acquisition, or sale of assets.

International transfers

Because Stand-by Tours operates as a global marketplace and relies on third-party providers (including some based outside the European Economic Area), your data may be transferred to and processed in countries other than your own or Cyprus. Where this happens, our providers are required to maintain appropriate safeguards — such as Standard Contractual Clauses or an equivalent adequacy mechanism recognized under EU data protection law.

How long we keep your data

We keep personal data for as long as necessary to provide the service and fulfil the purposes described above — including the period needed to meet our legal, tax, and accounting obligations, which under Cyprus law can extend for several years after a booking is completed. Account data is kept for as long as your account remains active, and deleted or anonymized within a reasonable period after you close it, unless we're legally required to retain it for longer.

Your rights

If you're located in the EU/EEA or the UK, you have rights under the General Data Protection Regulation (GDPR), including the right to:

Access the personal data we hold about you
Correct inaccurate or incomplete data
Request deletion of your data, subject to our legal retention obligations
Object to or restrict certain processing
Request a portable copy of your data
Withdraw consent at any time, where processing is based on consent

Many of these — including your notification preferences and personal details — can be managed directly from your account settings. For anything else, email us at support@standbytours.com. If you're not satisfied with our response, you have the right to lodge a complaint with the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus, or your own country's data protection authority.

Cookies

We use cookies and similar technologies to run the platform, remember your preferences, and understand how the site is used. You control non-essential cookies through our cookie preferences center. Full details — including exactly which categories we use and why — are in our Cookie Policy.

Children's privacy

Stand-by Tours is not directed at children, and accounts may not be created by anyone under 18. Where a tour booking includes a minor as a participant (for example, a family booking), that information is provided by the adult account holder making the booking, not collected directly from the child.

Changes to this policy

We may update this Privacy Policy as our platform, or the data we process, changes. Material changes will be reflected by updating the date at the top of this page, and where a change is significant, we'll take reasonable steps to make it more prominent.