Privacy policy

1. What this policy covers

This policy explains how SapTour collects, uses and protects personal data when you browse our store, request a quote, make a booking or contact support. SapTour is operated by a Hong Kong registered company, which is the data controller for the purposes described here.

2. Data we collect

  • Booking data — name, email address, phone number, pickup and drop-off addresses, travel dates and times, flight numbers, passenger and luggage counts, and any notes you give us.
  • Traveller data — where you book for other people, the names and any age details needed for the booking.
  • Payment data — the payment method, transaction reference and billing country. Card numbers are handled by our payment providers; we do not receive or store full card numbers.
  • Communications — the content of emails, chat messages and support conversations with us.
  • Technical data — IP address, device and browser type, pages viewed and the site you arrived from, collected through cookies and similar technologies.

3. Why we use it

  • To confirm, operate and deliver the service you booked, including passing your pickup details to the assigned driver
  • To take payment, issue refunds and keep accounting records
  • To provide support before, during and after your trip
  • To send booking confirmations and service updates — these are not marketing
  • To improve our routes, pricing and site experience
  • To prevent fraud, enforce our terms and meet legal obligations
  • To send marketing you have opted into, which you can stop at any time

4. Who we share it with

  • Drivers and local operators — only the details needed to run your service
  • Payment providers — to process the transaction and handle disputes and refunds
  • Ticket suppliers — where an attraction ticket must be issued in a traveller's name
  • Hosting, analytics and communication providers — who process data on our instructions
  • Authorities — where we are legally required to disclose

We do not sell personal data, and we do not share it for third-party advertising.

5. Cookies

We use cookies that are necessary for the store to function — keeping your cart, remembering your language and currency, and securing checkout. We also use analytics cookies to understand how the site is used. You can block or clear cookies in your browser; the booking and checkout parts of the site may not work correctly if you block the necessary ones.

6. How long we keep it

Booking and payment records are kept for as long as required for accounting, tax and dispute purposes. Support conversations are kept for a reasonable period afterwards. Marketing consent records are kept until you withdraw consent. Technical and analytics data is kept in aggregated or de-identified form where possible.

7. Transfers outside your country

Our providers and suppliers may be located in a different country from you, so your data may be processed outside your country of residence. Where the law requires it, we put contractual protections in place for those transfers.

8. Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, to correct it, to delete it, to restrict or object to certain processing, and to receive it in a portable format. To exercise any of these, contact us using the details on our contact page. We will respond within the period required by applicable law. You may also complain to your local data protection authority.

9. Security

We protect data with encryption in transit, access controls limited to staff and drivers who need it, and payment processing that is handled entirely by our payment providers. No system is perfectly secure; if a breach affects your rights we will notify you and the relevant authority as required.

10. Children

Our services are booked by adults. We do not knowingly collect personal data from children except where a child's name or age is supplied by the booking adult because a supplier requires it.

11. Changes to this policy

We may update this policy. The version in force is the one published on this page when you use the site.