01Who is responsible for your data
Dana Tours is responsible (the “controller”) for the personal data described in this policy.
We process personal data under Ecuador’s Organic Law on Personal Data Protection (LOPDP) and its regulation. If you live in the European Union, the United Kingdom or Switzerland, you also have the rights that the GDPR gives you, and we respect them.
02What we collect and why
We only ask for what we need to answer you and to run your trip. We collect it directly from you, from the person who books for your group, or from your travel agent.
| When | What data | Why we use it | Legal basis |
|---|
| You ask about a cruise or tour | Name, email, phone if you give it, travel dates, number of travellers, the yacht or tour, your message, and the page or ad that brought you | To answer you, check live availability with the yacht operator and send you a quote | Steps you ask for before a contract |
| You book | For each traveller: full name as in the passport, gender, marital status, date of birth, nationality, passport number, expiry date and a copy; bedding preference; flights; hotel the night before; an emergency contact | To reserve cabins, flights and services; to register you with the operator, the Galápagos National Park and the Galápagos Government Council; to issue vouchers and your invoice | Our contract with you; legal obligations (park registration, tax) |
| You pay | Name of the payer, amount, date and the payment reference. Card payments go through a secure payment provider; our website does not store card details | To take payments and refunds and keep our accounts | Contract; legal obligation (accounting and tax) |
| You use our website | IP address, browser and device, approximate location (country or city), pages viewed, clicks and scrolls, and the site or ad that brought you | Visit statistics, fixing pages that do not work well, measuring and showing our ads, and blocking spam | Our legitimate interest in a safe, useful website; your consent where the law requires it (see Cookies) |
We handle your data both by hand and with computer systems (our email and our booking database). We do not take decisions about you by automated means alone.
Why we need a passport copy. Galápagos operators register every passenger with the National Park and for the Transit Control Card (the Galápagos Government Council’s form also asks for gender and marital status), and airlines need passport details to issue tickets. Ecuadorian tax rules also ask us to keep proof that the service was sold to a non-resident traveller, so a copy of the passport stays with your invoice.
03Health and dietary information
Allergies, dietary needs, medical conditions and mobility needs are sensitive data. We ask for them only so the crew, the guides and the hotels can look after you safely, and we use them only with your explicit consent. We pass them only to the yacht, hotel or guide who needs them.
In a medical emergency during your trip we may share what is necessary with doctors, insurers or your emergency contact to protect your life and health.
04Who receives your data
We never sell, rent or trade your personal data. We share it only with the people and companies that make your trip possible, or when the law requires it:
| Who | Why | Where |
|---|
| The yacht or cruise operator, hotels and lodges, guides, drivers and domestic airlines | To deliver the services you booked | Ecuador |
| Galápagos National Park Directorate and Galápagos Government Council (usually through your operator) | Park entrance and the Transit Control Card, required by law | Ecuador |
| Ecuadorian authorities: the Internal Revenue Service (SRI) and, when the law requires it, migration, police or courts | Invoices and legal obligations | Ecuador |
| Technology providers that work for us under contract: InMotion Hosting (website, email and booking database), Cloudflare (security and speed), MailChannels (email delivery), Google (Analytics, Ads, reCAPTCHA and fonts), Microsoft (Clarity) and our payment provider (card payments) | To run our website, email and payments. They may use your data only on our instructions | USA and other countries |
| WhatsApp (Meta) | Only if you choose to write to us on WhatsApp | USA and other countries |
| Insurers, embassies and medical services | Only in an emergency or if you ask us | Where needed |
05International transfers
Your trip takes place in Ecuador, our website and email servers are in the United States, and some of our providers work from other countries. Whenever your data leaves Ecuador (or, for European and UK visitors, the EEA or the UK), we use providers that commit by contract to protect it, such as data processing agreements and the European Commission’s standard contractual clauses. You can ask us for details of these safeguards.
06How long we keep it
- Enquiries that do not become a booking: 24 months after our last contact, then deleted.
- Bookings, invoices and passport copies: 7 years after your trip, as Ecuadorian tax and accounting rules require.
- Health and dietary information: deleted 6 months after your trip ends, unless it is needed for a claim or an insurance case.
- Website statistics: as shown in the cookie table below.
When a period ends, we delete or anonymise the data, unless the law or a pending claim requires us to keep it longer.
07How we protect it
- Every page of our website uses an encrypted connection (HTTPS), and Cloudflare protects it from attacks and spam.
- Only the members of our team who need your data can open it, each with personal access.
- Passport copies and health information go only to the suppliers who need them for your trip.
- Our website does not store card details.
No system is completely secure. If a security incident puts your rights at risk, we will tell you and the Ecuadorian data protection authority within the deadlines set by law.
08Cookies and analytics
Cookies are small files that a website stores in your browser. These are the ones our website uses (checked in October 2026):
| Cookie | Provider and purpose | Lasts | Type |
|---|
| laravel-session, XSRF-TOKEN | Dana Tours: keeps your search on the cruise dates & prices pages and protects our forms | 2 hours | Necessary |
| dt_consent | Dana Tours: remembers your cookie choice | 6 months | Necessary |
| __stripe_mid, __stripe_sid | Stripe: fraud prevention for card payments (only on our payment pages) | 1 year / 30 minutes | Necessary |
| _GRECAPTCHA | Google reCAPTCHA: stops spam on our forms (loaded when you use a form) | 6 months | Necessary |
| __cf_bm | Cloudflare: tells people from bots, only when needed | 30 minutes | Necessary |
| _ga, _ga_QKGDHP3XSL | Google Analytics: visit statistics | Up to 400 days | Statistics |
| _clck, _clsk | Microsoft Clarity: records how visitors move through our pages (clicks, scrolls, heatmaps and session replays) so we can see where they are hard to use. What you type into our forms is masked and never recorded | Up to 1 year | Statistics |
| _gcl_au | Google Ads: measures which ads lead to an enquiry | 90 days | Advertising |
| IDE (doubleclick.net) | Google Ads: may show our ads on other websites to people who visited ours | Up to 400 days | Advertising |
The travel blog uses no statistics or advertising cookies; Cloudflare counts its visits without cookies.
Third-party vendors, including Google, use cookies to show our ads on other websites based on your past visits to ours; this is the only profiling we do. To learn how these companies use the data, see How Google uses information from sites that use its services and the Microsoft Privacy Statement.
Visitors from the European Economic Area, the United Kingdom, Switzerland and Ecuador see a short notice on their first visit: we only use statistics and advertising cookies if they accept. Everyone can change their choice at any time with Your privacy choices at the bottom of every page. We also honour your browser’s Global Privacy Control (GPC) signal: with it, advertising cookies stay off.
You can also control cookies in your browser settings, by turning off personalised ads in Google My Ad Center, or with the Google Analytics opt-out add-on. Necessary cookies cannot be switched off, because the pages and forms would not work without them.
09Emails we send
We do not send newsletters or advertising emails, and we never send unsolicited email, text messages or WhatsApp messages. We write to you only about your enquiry or your booking. When you send us a request, our website emails you an automatic confirmation; that is a service message, not an advertisement.
If one day we offer a newsletter, we will send it only to people who sign up for it, with a way to unsubscribe in every message.
10Your rights
- AccessSee the data we hold about you and how we use it.
- Rectification and updateCorrect data that is wrong or incomplete.
- DeletionAsk us to delete your data when we no longer need it.
- ObjectionObject to our use of your data.
- Restriction and cancellationAsk us to limit or stop a use of your data.
- PortabilityReceive your data in a common electronic format.
- Withdraw consentAt any time; it does not affect what we did before.
- No automated decisionsNot to be subject to decisions made only by machines.
How to use them: email [email protected] with the subject “Privacy request”, say which right you want to use and give us enough information to find your file. If we need to confirm your identity we will ask for as little as possible. It is free, and we answer within 15 days, as Ecuadorian law requires.
Complaints: please write to us first so we can fix it. If you are not satisfied, you can complain to Ecuador’s Superintendency of Personal Data Protection (SPDP). If you live in the EU, the UK or Switzerland, you can also contact your local data protection authority.
11Children and companions
Our website is meant for adults. When a family books, parents or legal guardians give us the children’s details and consent for them, and we use those details only to book the trip.
If you book for other travellers, please make sure they agree and show them this policy. You are responsible for the data you give us about them being correct.
12Other things you should know
- If data is missing or wrong: the operator, the National Park and the airlines need booking data exactly as in your passport. Without it we cannot confirm your trip, and a wrong name can mean being refused boarding. Please tell us of any change.
- Other websites: links to WhatsApp, Tripadvisor or operator websites follow those companies’ own privacy policies.
- Changes to this policy: we show the date of the latest version at the top of this page. If we make an important change and you have a booking with us, we will email you.
