Privacy Policy

Important: This document is boilerplate and does not constitute legal advice. You should have it reviewed by a qualified lawyer before relying on it, especially regarding GDPR compliance in Malta.

1. Introduction

CET Leisure Ltd ("we", "us", or "our") operates GuideBook.mt (the "Platform"). This Privacy Policy explains how we collect, use, disclose, and protect personal data when you visit our website or use our services.

We are the data controller for personal data processed through the Platform. If you have questions, contact us at privacy@guidebook.mt.

2. Who This Policy Applies To

This policy applies to:

Guides (Professional Licensed Tour Guides)
Agents (Licensed Travel and Tourism Agents and agency staff)
Visitors to our public website
Platform administrators

3. Personal Data We Collect

3.1 Information you provide

Account data: name, email address, password (stored in hashed form), role (Guide or Agent), professional registration number
Agency data: agency name and registration number (for Agents)
Profile data: phone number, address, biography, profile photo, languages, tour types, pricing, video links, and other information you choose to add
Booking data: booking requests, dates, tour details, status, notes, and messages exchanged in connection with bookings
Communications: messages you send through the Platform and correspondence with our support team
Calendar integration data: if you connect Google Calendar or upload ICS files, we may store calendar sync settings, tokens, and booking-related calendar events

3.2 Information collected automatically

Usage data: pages visited, features used, and actions taken on the Platform
Device and log data: IP address, browser type, operating system, and timestamps
Cookies and session data: see Section 9

3.3 Information from third parties

Google Calendar: if you authorise calendar sync, we receive calendar access tokens and calendar event data as permitted by your Google account settings
Verification data: information used to verify your professional licence or agency status

We do not intentionally collect special categories of personal data (such as health or biometric data). Please do not submit such data through the Platform unless necessary and with appropriate consent.

4. How We Use Personal Data

We use personal data to:

Create and manage your account
Verify Guide and Agent eligibility
Enable search, booking requests, and messaging between users
Display profiles and availability to other authorised users
Sync bookings with connected calendar services
Send transactional emails (account verification, booking notifications, password resets)
Provide customer support
Improve, secure, and maintain the Platform
Comply with legal obligations
Enforce our Terms of Service

We process data on the following legal bases under the GDPR:

Contract: to provide the Platform and services you request
Legitimate interests: to operate, improve, and secure the Platform, and to prevent fraud or abuse
Consent: where required (for example, optional calendar integrations or marketing communications)
Legal obligation: where we must retain or disclose data by law

5. How We Share Personal Data

We may share personal data with:

Other Platform users: profile and booking information is visible to relevant Guides and Agents as part of normal Platform operation (for example, an Agent viewing a Guide's profile, or a Guide receiving a booking request)
Service providers: hosting, email delivery, and infrastructure providers who process data on our behalf under data processing agreements
Google: when you connect Google Calendar, in accordance with Google's API Services User Data Policy
Authorities: where required by law, court order, or to protect our rights and safety

We do not sell your personal data.

6. International Transfers

Your data is primarily processed within the European Economic Area (EEA). If we transfer data outside the EEA, we will ensure appropriate safeguards are in place (such as Standard Contractual Clauses) as required by GDPR.

7. Data Retention

We retain personal data for as long as your account is active and as needed to provide the Platform. We may retain certain data longer where required by law, to resolve disputes, or to enforce our agreements.

When you delete your account, we will delete or anonymise your personal data within a reasonable period, except where retention is legally required or permitted.

8. Your Rights

Under the GDPR and Maltese data protection law, you may have the right to:

Access your personal data
Rectify inaccurate data
Erase your data ("right to be forgotten") in certain circumstances
Restrict processing in certain circumstances
Object to processing based on legitimate interests
Data portability — receive your data in a structured, machine-readable format
Withdraw consent where processing is based on consent

To exercise these rights, contact us at privacy@guidebook.mt. We will respond within one month, as required by law.

You also have the right to lodge a complaint with the Office of the Information and Data Protection Commissioner (IDPC) in Malta: https://idpc.org.mt.

9. Cookies and Similar Technologies

We use cookies and similar technologies to:

Keep you logged in (session cookies)
Remember your preferences
Maintain security (CSRF protection)
Understand how the Platform is used

Essential cookies are necessary for the Platform to function. You can control non-essential cookies through your browser settings, though disabling certain cookies may affect functionality.

10. Security

We implement appropriate technical and organisational measures to protect personal data, including encryption in transit (HTTPS), access controls, and secure password storage. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

11. Children's Privacy

The Platform is not intended for users under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

12. Third-Party Links

The Platform may contain links to third-party websites or services. We are not responsible for their privacy practices. Please review their privacy policies before providing personal data.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the revised policy on the Platform and update the "Last updated" date. Material changes may be communicated by email or through a notice on the Platform.

14. Contact Us

For privacy-related enquiries or to exercise your data protection rights:

CET Leisure Ltd
Email: privacy@guidebook.mt
Website: https://guidebook.mt

[Insert registered company address]

Data Protection Contact: privacy@guidebook.mt