Last revision: 13th of August 2025

Tour Desk ehf. (“TourDesk”, “We”, “Us”, “Our”) is committed to protecting your privacy and data. We know that your privacy is very important to you, and we have set up this policy to help you understand what information we collect, how we use that information, who can access it, where and what information is shared, and how we protect that information. This policy applies to all TourDesk systems/applications including white label sales portals, Agent systems, API, customer support, phone service, registration process, and checkout.

We take the security of our clients’ data very seriously. Some of the information collected, processed, and presented through TourDesk services qualifies as personal data under applicable law. We protect it to the fullest extent possible and take all necessary measures to ensure compliance with the General Data Protection Regulation (GDPR) and other applicable data protection regulations.

1. The types of information we collect

a. Information You Provide Directly
When you make a purchase, or you register as an affiliate or supplier, we collect the information that you give us. That information may include:

• Identity Data: First name, last name, company name
• Contact Data: Email address, phone number, company email address, company phone number
• Transaction Data: Payment details for services purchased (excluding full card numbers)
• Profile Data: Hotel size, company homepage, supplier system used, country, operating regions, time zone

b. Information Collected Automatically While You Use Our Services

While using our services, we may collect certain technical and usage information, such as:

• Device details (IP address, product model, operating system, browser type, and version)
• Sign-in activity (timestamps, IP addresses)
• Location data (to determine, for example, the country from which a purchase was made)
• Change logs and actions taken within our systems

When signing in to the Agent system, we will store information about your IP address, product model, operating system, browser type, and browser version, as well as what times you signed in.

c. Payment Processing

When completing a purchase through checkout or the agent system, we will store information on your IP Address. The IP address might be used to determine the country where your purchase was made.

Your card details are not stored with TourDesk. At the time of purchase, they are sent directly to a card acquirer. Your name, email, or phone number is not sent to the acquirer. All our card acquirers are PCI-certified. They store your card information and give us a virtual number for later use.

We store that virtual number along with the last 4 digits of your card number. In case of cancellations or other problems, this allows us to refund directly to your card without you having to give out your card details to support personnel.

d. Cookies and Analytics

We use cookies and similar technologies to improve your experience, ensure site security, and understand how visitors use our website. A cookie is a small file stored on your device that allows us to recognise your browser, remember your preferences, and analyse website traffic.

Our website uses:

• First-party cookies (essential)
  • Required for basic website functionality, such as remembering your login session and preferences.
  • These are always enabled because they are necessary for the website to function properly.
  • You can read our full Cookie Policy.
• Third-party cookies (analytics)
  • Provided by Google Analytics, which may include the Google Analytics Demographics feature.
  • This gives us anonymised, aggregated data about visitor age, gender, and interests to help us understand browsing behaviour and improve our services.
  • The information collected is aggregated and does not identify individual users.
  • You can learn more in Google’s Privacy Policy.

Cookie Use and Your Choices

We use cookies to analyse how you found our website, how you use it, and, in some cases, whether you made a purchase. Non-essential cookies, such as analytics, are only set if you consent via our cookie banner or preference centre. You can withdraw your consent or change your cookie preferences at any time. You can also opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.

e. Reseller Partner Analytics
Reseller partners may add their own Google Analytics tracking code to their reseller pages, giving them access to similar anonymised analytics data as described above. These activities are subject to the reseller’s privacy policy.

2. How we use your information

We use the information you provide to us, and the information we collect automatically, for the following purposes:

• Deliver, maintain, and improve our services, including operating our systems, processing bookings, and ensuring service quality. Legal basis: performance of a contract
• Provide services you request: fulfilling orders, arranging bookings, and managing your account. Legal basis: performance of a contract
• Develop new services and features: analysing user feedback and usage patterns to improve offerings. Legal basis: legitimate interest
• Suggest personally relevant features and offer customised content — tailoring services to your preferences. Legal basis: consent (for non-essential personalisation) or legitimate interest (for basic service improvement)
• Provide tailored advertising: showing relevant offers or promotions based on your preferences. Legal basis: consent
• Protect TourDesk and our users: investigating and preventing fraudulent or illegal activity, enforcing our terms, and maintaining system security. Legal basis: legitimate interest and legal obligation
• Communicate with you: responding to your queries, notifying you of changes to our policies or services, and informing you about other services we offer (where permitted).
  Legal basis: performance of a contract, legal obligation, or consent (for marketing)

We may use cookies, or other similar technologies, on some of the features of our services. Cookies are small files that are typically downloaded to the browser application on your device. Cookies help us to ensure the safety and smooth functioning of certain features of our services, and they also help us to collect information about your user preferences. We sometimes use information collected from cookies to improve your user experience and the quality of our services. For example, by saving your user preferences, we may be able to customize our services in ways that you prefer. You may be able to disable cookies in your browser settings or set your browser to alert you when cookies are being used. If you disable cookies, you may not be able to use all of the features of our services.

Some web browsers may transmit "do not track" signals. We currently do not take action in response to these signals. Analytics providers are third-party companies that collect information when you use some of our services. These companies use cookies, web beacons, software development kits (SDKs), and similar technologies to collect and analyze crash reports, keep track of what content or ads you view, how long you spend on different pages, how you arrived on a particular page, and how you respond to the ads we show you. Analytics providers may combine the information they collect from our services with other information they collect from other sites and services. The practices of these third-party analytics providers are governed by their privacy policies. The analytics providers with whom we work include, de but are not limited to, the companies listed below. Some of these companies, including those listed on the page linked below, may give users choices about how they collect and use your information. By browsing our sites, you accept our cookie policy.

We also may permit our partners/resellers to set their analytics tracking cookies, like Google Analytics or Facebook Pixel. These will also be on an opt-in basis.

a. Payment and Booking Follow‑ups
If a guest begins but does not complete a booking in the TourDesk portal, we may contact the guest by email shortly afterward to help them complete the process. These follow‑up emails are sent from booking@tourdesk.com, typically within 15 minutes of their first attempted payment. They are intended to assist with resolving potential payment issues or answering questions they may have.

These communications:

• Are only sent if no successful booking has been made using the same name or email address in the meantime.
• May include tracking parameters (e.g., utm_source, utm_medium, utm_campaign) to help us attribute visits and bookings generated from these emails.
• Are designed to provide a smooth booking experience and may be sent by TourDesk on behalf of an affiliate partner.
• Contain links that return the guest to their saved cart so they can easily complete their booking.

You have the right to object to such communications at any time by replying to the email or contacting us at info@tourdesk.com.

b. Children's data

Our services are not intended for individuals under 16 years of age, and we do not knowingly collect personal data from them.

3. How is your information shared

We may share your information:

• For legal and business purposes, such as complying with legal processes, responding to claims, enforcing our terms, or protecting rights, property, or safety (legal obligation)
• As part of a sale or transfer of company assets, where permitted by law
• With resellers (e.g., hotels), if you purchase them, they will have access to your name, email address, phone number, and purchase details (but not your credit card details)
• With suppliers through their booking systems — these fall under the supplier’s privacy policy. You can view our list of supported supplier systems

TourDesk does not store your credit card or other payment information. TourDesk uses PCI-certified acquirers that store your information according to the PCI regulations. They return to us a virtual number that we store along with the last 4 digits of your card number for identification. See a list of the Tour Desk’s acquirers here.www.tourdesk.io/Docs/PaymentAcquirers

Tour Desk employees will have access to your name, email address, phone number, and purchase history through TourDesk's internal administration system. Employee access to the internal administration system is logged.

4. Your choices

In some cases, you can choose what information we collect and how it is shared — for example, opting out of marketing communications or declining non-essential cookies.

Some information sharing is mandatory: for example, payment details must be shared with our payment acquirer to process transactions. To exercise any of your rights or choices, contact us at info@tourdesk.com.

5. Security

We implement administrative, physical, and technical security measures to protect your information from loss, theft, misuse, unauthorised access, disclosure, alteration, or destruction.

• Passwords are securely hashed and salted using an industry-standard algorithm.s
• Payment card numbers and CVC codes are never stored by TourDesk
• All internet-facing applications communicate over SSL with 2048-bit encryption
• Access to personal data is restricted to authorised personnel and is logged

While we take all reasonable precautions, no method of transmission or storage is completely secure.

6. Changes to this policy

We may update this Privacy Policy from time to time. The “Last Revision” date at the top of the page will be updated accordingly. If we make material changes affecting how we use or share your data, we will notify you in advance via your registered email address. If you are a partner or have a user account with TourDesk, we will send any updates made to the privacy policy to your email address.

7. GDPR

All of our customers and partners will enjoy the same data protection regulations according to the EU data protection law (including the General Data Protection Regulation 2016/679 (the “GDPR”). TourDesk acts as a data controller under the General Data Protection Regulation (GDPR).

Your GDPR rights include:

• Right to access your data
• Right to rectification of inaccurate data
• Right to erasure (“right to be forgotten”)
• Right to restrict processing
• Right to data portability
• Right to object to processing (including profiling for marketing)
• Right to withdraw consent at any time (where processing is based on consent)

a. How can you access your personal information
You are also entitled to ask us to port your personal information (i.e., to transfer it in a structured, commonly used, and machine-readable format to you), to erase it, or restrict its processing. You also have the right to object to some processing that is based on our legitimate interests, such as profiling that we perform for direct marketing, and, where we have asked for your consent to process your data, to withdraw this consent as more fully described below.

These rights are limited in some situations – for example, we can demonstrate that we have a legal requirement to process your personal information. In some instances, this means that we may retain some data even if you withdraw your consent.

Where we require your personal information to comply with legal or contractual obligations, then the provision of such data is mandatory: if such data is not provided, then we will not be able to manage our contractual relationship with you or meet obligations placed on us. In all other cases, the provision of requested personal information is optional.

If you have unresolved concerns, you also have the right to complain to data protection authorities. The relevant data protection authority will be the data protection authority of the country: (i) of your habitual residence; (ii) of your place of work; or (iii) in which you consider the alleged infringement has occurred.

We try to respond to all legitimate requests within one month. Occasionally, it may take us longer than a month if your request is particularly complex or you have made several requests. In this case, we will notify you and keep you updated.

8. Contact information

If you have questions, concerns, or comments regarding this Privacy Policy or our data practices, you can contact us:

• Email: info@tourdesk.com
• Phone: +354 553 4321
• Mail: Tour Desk ehf., Lækjartorg 5, 101 Reykjavík, Iceland