Privacy Policy

Last updated: 2 November 2026

This Privacy Policy consists of two parts. Part A — Website and Tours covers the website in general and tour bookings. Part B — Harmony Shop adds the information specific to orders placed in the Harmony Shop. Unless Part B provides otherwise, Part A also applies to the Harmony Shop, including the sections on analytics, cookies, data security, privacy requests, legal requirements and contact.

Part A — Website and Tours

1. About This Privacy Policy

This Privacy Policy explains how Harmony Tours collects, uses and protects personal information when customers use our website, contact us, make a booking, or use our services.

Harmony Tours is a tour operator based in Hurghada, Red Sea, Egypt.

Contact:

Email: info@harmony-wycieczki.com
Egypt: +20 155 593 5998
Poland: +48 532 252 332

2. Information We May Collect

Depending on how a customer uses our website or services, we may collect information including:

Name
Email address
Telephone number
Booking reference
Tour or activity selected
Booking date and activity date
Number of participants
Participant categories or ages where required for pricing or eligibility
Hotel, accommodation or pickup information
Pickup area and applicable pickup arrangements
Information voluntarily provided in booking notes or communications
Communications with Harmony Tours relating to bookings, cancellations, customer service or support
Booking price, currency, applicable surcharges and transaction-related information
Technical information generated when using our website where applicable, such as device/browser information, IP address and website usage information

We only request information that is reasonably necessary for providing, administering, supporting or improving our services.

3. How We Use Personal Information

We may use personal information to:

Process and manage bookings
Check availability
Calculate and confirm booking prices
Arrange pickup and transportation
Communicate booking confirmations, references and operational information
Contact customers regarding changes to a booking or activity
Provide customer support
Process cancellation and refund requests
Prevent duplicate, fraudulent or unauthorized transactions
Maintain booking and transaction records
Improve the operation and usability of our website and services
Meet applicable legal, accounting, regulatory or security requirements

4. Booking Information

Information entered during the booking process is used to create and administer the customer's reservation.

The customer is responsible for ensuring that the information supplied is accurate.

Where a customer provides information about other participants in the same booking, the customer should ensure that they are authorized to provide the information necessary to administer that booking.

5. Payments

Where online payment is available, payments may be processed by an authorized third-party payment service provider.

Payment-card details may be entered directly into the payment provider's checkout or payment environment rather than being collected by Harmony Tours.

Harmony Tours does not intend to store full payment-card numbers, card security codes (CVV), or other sensitive card-authentication data on its systems.

Harmony Tours may receive and retain non-sensitive transaction information necessary to administer a booking, such as:

Payment status
Amount and currency
Internal payment reference
Provider transaction/reference identifier
Payment or verification timestamp
Safe transaction status or failure information where required for support and reconciliation

The payment provider may process personal and payment information under its own privacy and security terms.

The specific payment provider will be identified where appropriate once online payment is activated.

6. Sharing Information With Service Providers

Harmony Tours may share information necessary to provide a booked service with relevant service providers involved in fulfilling the booking.

Depending on the activity, these may include transport providers, boat or activity operators, guides, attractions, or other tourism suppliers.

Only information reasonably necessary to arrange or provide the booked service should be shared.

We may also use technology, hosting, communications, email, analytics or payment service providers where required to operate the website and provide our services.

These providers may process information on our behalf or under their own applicable privacy terms.

When analytics is enabled and you consent to Analytics cookies, information about your use of the website is processed by Google through Google Analytics, as described in section 8 and in our Cookie Policy.

7. Communications

Harmony Tours may use the telephone number, email address or other contact details provided by a customer to communicate about:

Booking confirmations
Pickup information
Schedule or operational changes
Cancellations
Customer-service requests
Important information relating to a booked activity

Customers may also choose to contact Harmony Tours through available communication channels such as telephone, email or WhatsApp.

Communications made through third-party platforms may also be subject to the privacy terms of those platforms.

8. Website Analytics and Technical Information

When analytics is enabled on the live public website and you have consented to Analytics cookies, Harmony Tours uses Google Analytics 4, provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA ("Google"), to understand in aggregate how the website is used and to improve its performance and customer experience. Nothing is loaded or sent to Google before you give that consent, and you can withdraw it at any time using the "Cookie Preferences" link in the website footer.

This may include information such as:

Browser, device and operating-system type
Approximate location derived from your IP address (according to Google, for users in the EU, Switzerland and the United Kingdom the IP address is not logged or stored)
Pages viewed and the page from which you arrived, limited to the page path and campaign parameters
General website interaction information, such as visit duration
Referral or campaign information where applicable
A randomly generated identifier stored in Google Analytics cookies

Web addresses are filtered before they are sent: payment-link tokens, hotel names, guest numbers, booking dates, search text and other query details are removed. Google Analytics is not used on internal staff areas, technical interfaces or payment-link pages. We do not send names, email addresses, telephone numbers, booking references or payment information to Google Analytics, and its advertising features (Google Signals, advertising personalisation and advertising storage), user IDs, and ecommerce, purchase and conversion tracking are switched off.

Google Analytics keeps user-level and event-level data for 14 months; aggregated statistical reports are not affected by this setting.

Legal basis. We use Google Analytics only with your consent (Article 6(1)(a) GDPR); the Google Analytics cookies are likewise stored on and read from your device only with your consent. Google Analytics is not loaded and no data is sent to Google before you consent. You can withdraw your consent at any time via the "Cookie Preferences" link in the website footer; this does not affect the lawfulness of processing carried out before the withdrawal.

Google's role. Google processes this data on our behalf as our data processor under the Google Ads Data Processing Terms, which apply to Google Analytics. We have not enabled the Google Analytics data-sharing settings that would allow Google to use this data for its own purposes.

International transfers. Google may process this data outside the European Economic Area, including in the United States. For such transfers Google relies on the EU-U.S. Data Privacy Framework, under which Google LLC is certified (and, where applicable, on its UK Extension and the Swiss-U.S. Data Privacy Framework), and, where no such framework applies, on the European Commission's Standard Contractual Clauses.

Optional Enhanced Measurement events are disabled.

Applicable terms: Google Analytics Terms of Service and Google Ads Data Processing Terms.

Details of the cookies used, their lifetimes and how to change your choice are in our Cookie Policy.

9. Cookies and Similar Technologies

The Harmony Tours website uses a small number of essential cookies and browser local storage needed for core site functionality, such as remembering your cookie preference and completing a booking submission.

On your first visit, a cookie banner lets you Accept All, allow Essential Only, or independently choose Analytics and Marketing cookies — both are switched off by default and only load if you turn them on. When analytics is enabled on the website, the Analytics category uses Google Analytics, which loads only after you grant Analytics consent. The Marketing category uses the Meta Pixel, provided by Meta Platforms Ireland Limited, which loads only after you grant Marketing consent. Harmony Tours and Meta are joint controllers under Article 26 GDPR for collecting this data and transmitting it to Meta; Meta is responsible for its later processing, which may take place outside the European Economic Area, including in the United States. Details are in our Cookie Policy.

You can review or change your choice at any time using the "Cookie Preferences" link in the website footer. See our Cookie Policy for full details.

Partner referral links

Some of our partners (for example travel agents, hotel representatives or creators) recommend Harmony Tours with a personal link. If you open our website through such a link and accept Marketing cookies, we store a first-party cookie (ht_ref) in your browser for 30 days. It contains only the partner's referral code and the time the link was opened, and is protected against changes. If you then book a trip, a SPA visit or order from the Harmony Shop, we record on your booking or order which partner referred you, so that we can pay that partner a commission.

The partner does not receive your name, contact details, booking details or payment information; they only see that a sale they referred was completed and its value.

Legal basis: your consent (Art. 6(1)(a) GDPR). If you do not accept Marketing cookies, no referral cookie is set and your booking is not attributed to a partner. You can withdraw your consent at any time in Cookie Preferences; the cookie is then removed. Withdrawal does not affect bookings already made. The referral information on a booking or order is kept for as long as we keep that booking or order (see the retention section).

10. Data Retention

Harmony Tours retains personal information only for as long as reasonably necessary for the purposes for which it was collected, including providing services, maintaining appropriate booking and transaction records, resolving disputes, and meeting applicable legal, accounting or regulatory requirements.

Different types of information may need to be retained for different periods.

11. Data Security

Harmony Tours takes reasonable organizational and technical measures designed to protect personal information against unauthorized access, loss, misuse, alteration or disclosure.

However, no internet-based service can guarantee absolute security.

Customers should not send payment-card security codes or other unnecessary sensitive payment information to Harmony Tours through email, WhatsApp, booking notes or other general communication channels.

12. Customer Privacy Requests

Customers may contact Harmony Tours to ask questions about personal information held in connection with their bookings or to request appropriate correction or other handling of their information.

Requests are subject to applicable law and any legal or operational requirements that require Harmony Tours to retain particular records.

Privacy requests can be sent to:

info@harmony-wycieczki.com

13. Third-Party Websites and Services

The Harmony Tours website may contain links to third-party websites or services.

Harmony Tours is not responsible for the privacy practices of independent third-party websites or services.

Customers should review the privacy information provided by those services where appropriate.

14. Children's Information

Harmony Tours may process a child's age or participant category where necessary to determine pricing, eligibility, safety requirements or booking arrangements for a tour or activity.

This information is provided as part of a booking made by a parent, guardian or other responsible adult.

Harmony Tours does not intentionally request unnecessary personal information directly from children through the booking process.

15. International Customers and Service Delivery

Harmony Tours serves customers from different countries.

Where necessary to administer a booking or provide a booked activity, information may be processed using service providers or communication systems that operate across different countries.

Harmony Tours will use personal information only as reasonably necessary for the purposes described in this Privacy Policy and subject to applicable requirements.

16. Legal Requirements

Harmony Tours may retain or disclose information where reasonably necessary to comply with applicable law, lawful requests from competent authorities, legal proceedings, fraud prevention, security requirements, or the establishment, exercise or defense of legal claims.

17. Changes to This Privacy Policy

Harmony Tours may update this Privacy Policy when its services, website technologies, payment arrangements or legal requirements change.

The current version and its last-updated date will be published on this page.

18. Contact

For questions or requests concerning this Privacy Policy or personal information, contact:

Harmony Tours

Email: info@harmony-wycieczki.com
Egypt: +20 155 593 5998
Poland: +48 532 252 332

Part B — Harmony Shop

B1. Controller

Personal information processed for Harmony Shop orders is controlled by Harmony Tours, Hurghada, Red Sea, Egypt, which operates the Harmony Shop. Contact details are given in section 18 of Part A and in section B9.

B2. Information We Collect for Shop Orders

Name, email address and telephone number (which may also be used for WhatsApp)
Delivery area, hotel name, room number (optional) and notes for the delivery (optional)
Ordered products, quantities, prices, any promo code used, the delivery fee and the order total
Order number, order status and its history, and the planned delivery day
Payment method and payment status; for online payments, the non-sensitive transaction information described in section 5 of Part A
A record of the customer's acceptance of the Terms & Conditions and confirmation of having read this Privacy Policy: the time, the documents and versions shown, and a technical fingerprint of their text
Communications with Harmony Tours about the order, including by email or WhatsApp
Technical information needed to protect the checkout against automated abuse (see section B5)

The shopping cart is stored only in the customer's browser (local storage) until an order is placed.

B3. How We Use This Information

To accept, confirm, prepare and deliver orders
To contact the customer about the order and its delivery by email, telephone or WhatsApp
To send transactional emails about the order, such as receipt, confirmation, delivery, payment and cancellation
To process Cash on Delivery payments and, where offered, online payments, as well as cancellations, refunds and complaints
To apply promo codes; where a promo code is assigned to a member of the Harmony Tours sales team, the order is attributed to that person for internal sales and commission records
To prevent duplicate, fraudulent or abusive orders
To keep order, accounting and transaction records and to meet legal requirements

Delivery information is shared only with the Harmony Tours staff or courier delivering the order.

B4. Legal Bases

Where the GDPR or comparable legislation applies, Harmony Tours processes Shop order information because it is necessary to conclude and perform the contract with the customer (Article 6(1)(b) GDPR), to comply with legal obligations such as accounting and tax requirements (Article 6(1)(c) GDPR), and on the basis of its legitimate interests in preventing fraud and abuse, securing the website and handling claims (Article 6(1)(f) GDPR). Accepting the Terms & Conditions at checkout is part of concluding the contract; it is not consent to the processing of personal data.

B5. Service Providers

To operate the Harmony Shop, Harmony Tours uses service providers that process information on its behalf or under their own terms:

Hosting and database: Railway
Transactional email: Resend
Protection of the checkout against automated abuse (Cloudflare Turnstile) and storage of product images: Cloudflare
Technical error monitoring: Sentry, configured to limit the personal information it receives
Online card payments, only where offered: Kashier
WhatsApp (Meta), when the customer or Harmony Tours uses it to communicate about an order

Some of these providers may process information outside the customer's country, including outside the European Economic Area. Google Analytics is not used on the checkout, order-status or payment pages of the Harmony Shop.

B6. Retention

Shop order information is kept for as long as necessary to fulfil the order, to handle cancellations, complaints and refunds, and to meet accounting, tax and other legal record-keeping requirements; it is then deleted or anonymised. Records of acceptance of the Terms & Conditions are kept for as long as the related order record.

B7. Your Rights

Subject to applicable law, customers may request access to their personal information, its correction or deletion, the restriction of its processing and data portability, and may object to processing based on legitimate interests. Where processing is based on consent, the consent may be withdrawn at any time. Customers in the European Union may also lodge a complaint with a data protection supervisory authority, in particular in their country of residence. These rights apply to all personal information processed by Harmony Tours, including under Part A.

Requests can be sent to info@harmony-wycieczki.com. Harmony Tours may need to verify the identity of the person making the request and may retain records it is legally required to keep.

B8. Order Status Link

The order-status page is reached through a private link provided to the customer. The link should not be shared: anyone who has it can see the details of the order.

B9. Contact

For questions about personal information relating to a Shop order, contact:

Harmony Shop (Harmony Tours)
Email: info@harmony-wycieczki.com
WhatsApp: +20 155 179 3441

Part C — Facebook Messenger and AI Assistant

C1. What we process

When you write to our Facebook Page "Harmony Wycieczki Egipt" on Messenger, Harmony Tours processes: the text of your messages and of our replies; the type of any attachment you send (not the file itself); the date and time of messages; the identifier that Meta assigns to you for our Page; the language of the conversation; and travel details you choose to give us (for example your hotel or area, travel dates, number of adults and children's ages, interests). We do not obtain your name, profile photo, phone number or email address from Messenger.

C2. How our AI assistant works

Our team has 10 minutes to answer your first message. If no employee has replied by then, a virtual assistant based on artificial intelligence may answer. Its first reply clearly states that it is an AI assistant. It uses only the current excursion, price and booking information published on our website, and it never confirms bookings, payments or availability on its own. As soon as a Harmony Tours employee replies in the conversation, the assistant permanently stops replying there. Each new conversation is also assigned to one of our consultants.

C3. Purposes and legal bases

We use this information to answer your enquiry, recommend suitable excursions and prepare an offer (steps taken at your request before a contract, Art. 6(1)(b) GDPR), and to organise our customer service efficiently, including assigning conversations to our team (our legitimate interest, Art. 6(1)(f) GDPR).

C4. Service providers

Meta Platforms Ireland Limited provides Messenger. OpenAI OpCo, LLC (USA) generates the assistant's replies as our processor: we send it the text of the conversation, after removing email addresses and phone numbers, but never your Meta identifier. OpenAI does not use this data to train its models and may keep it for up to 30 days to detect abuse, after which it is deleted. Our systems are hosted by Railway. Some of these providers process data outside the European Economic Area; such transfers rely on the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework.

C5. Retention

Technical Messenger delivery data is deleted automatically after 30 days. Conversation records with the assistant (messages, travel details and assignment history) are deleted automatically 12 months after the last message, unless we need them longer to handle a booking, complaint or legal claim.

C6. Talking to a person

You can ask to speak to a person at any time — for example by writing "human" or "człowiek". The assistant then passes the conversation to our team and stops replying.

C7. Your rights and data deletion

You can ask for access to, correction or deletion of your Messenger conversation data, and object to its processing, by writing to info@harmony-wycieczki.com with the subject "Messenger data". We delete the conversation from our systems within 30 days of a deletion request and confirm by email. Messages also remain in Messenger itself under Meta's own terms. You may also lodge a complaint with a data protection authority.