1. Introduction
GuideUp Technologies Private Limited ("GuideUp", "we", "us", or "our") operates the GuideUp SaaS platform for tour operators. We are committed to protecting the personal data of our customers, their staff, and the end passengers whose data is processed through our platform.
This Privacy Policy describes what personal data we collect, why we collect it, how it is used and protected, and the rights you have in relation to your data. If you are a European Economic Area (EEA) resident, additional GDPR-specific protections apply and are detailed in this policy.
For any questions or data requests, contact us at legal@guideup.co.
2. Who We Are and Our Role
GuideUp Technologies Private Limited is incorporated in India and provides a cloud-based tour operations management platform primarily to tour operators based in Europe. Depending on the context:
- Data Controller: When GuideUp collects and processes data about visitors to our marketing website, prospective customers, or our own account holders (business contacts), we act as the data controller.
- Data Processor: When tour operators use our platform to manage their passengers' personal data (names, bookings, contact details), we act as a data processor on behalf of the tour operator (who is the data controller). In that context, our Data Processing Agreement (DPA) governs how we handle that data.
3. Personal Data We Collect
We collect different categories of personal data depending on how you interact with us:
Account and Business Data — when you register for a GuideUp account or subscribe to a plan, we collect your name, business email address, company name, country, and billing information. Payment card details are handled directly by Stripe and are not stored on our servers.
Usage and Technical Data — when you use the platform, we automatically collect log data including your IP address, browser type, device identifiers, pages visited, features used, and session timestamps. This data is used to maintain platform security and improve service quality.
Communication Data — if you contact us via email, the contact form, or a demo request form, we collect the information you provide in that communication.
Passenger and Booking Data (Processor Role) — when tour operators use GuideUp to manage tours, they input passenger data including names, contact details, nationality, booking references, and tour-specific details. GuideUp processes this data solely on the instruction of the tour operator under a DPA.
Cookie and Analytics Data — we use cookies and analytics tools to understand how visitors use our website. Please refer to our Cookie Policy for full details.
4. Legal Basis for Processing (GDPR)
For users in the EEA, we process personal data on the following legal bases:
- Contractual necessity: to set up and manage your subscription account, process payments, and provide the GuideUp platform.
- Legitimate interests: to improve our services, ensure platform security, prevent fraud, and communicate relevant product updates. We ensure our legitimate interests do not override your fundamental rights.
- Consent: for marketing communications and non-essential cookies. You can withdraw consent at any time.
- Legal obligation: to comply with applicable laws including tax regulations and law enforcement requests.
5. How We Use Your Data
We use personal data for the following purposes:
- Providing, operating, and maintaining the GuideUp platform
- Processing payments and managing subscriptions
- Sending transactional emails (booking confirmations, account alerts, invoices)
- Responding to support requests and inquiries
- Sending product update emails and newsletters (with consent)
- Detecting and preventing abuse, fraud, and security incidents
- Analysing platform usage to improve product features
- Complying with legal and regulatory obligations
We do not sell, rent, or trade your personal data to third parties for their own marketing purposes.
6. Data Retention
We retain personal data for as long as necessary to fulfil the purposes described in this policy:
- Active account data: retained for the duration of your subscription plus 90 days after account closure (to allow for reactivation or dispute resolution).
- Billing and financial records: retained for 7 years to meet statutory accounting requirements.
- Support correspondence: retained for up to 3 years.
- Server logs and technical data: retained for up to 90 days.
- Passenger and booking data (processor role): deleted or returned to the tour operator within 30 days of contract termination, as specified in the DPA.
You may request earlier deletion of your data by contacting us at legal@guideup.co, subject to any overriding legal obligations.
7. Third-Party Processors
We work with the following sub-processors to deliver our services. Each is bound by data processing agreements and appropriate safeguards:
- MongoDB Atlas — cloud database hosting (EU/US regions)
- DigitalOcean — cloud infrastructure (Amsterdam, EU)
- Stripe — payment processing (US/EU)
- Google OAuth — authentication services
- Resend — transactional email delivery
- Bokun — booking platform integration
A full and current list of sub-processors is available at our Sub-processors page.
8. International Data Transfers
GuideUp is operated by an Indian company and may process data on servers located in the EU (primarily Amsterdam, Netherlands via DigitalOcean). Where personal data from EEA residents is transferred outside the EEA, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission or equivalent mechanisms, where applicable.
9. Your Rights Under GDPR
If you are located in the EEA, you have the following rights regarding your personal data:
- Right of access: request a copy of the personal data we hold about you.
- Right to rectification: request correction of inaccurate or incomplete data.
- Right to erasure ("right to be forgotten"): request deletion of your data, subject to legal retention requirements.
- Right to restriction of processing: request that we limit processing of your data in certain circumstances.
- Right to data portability: receive your data in a structured, machine-readable format.
- Right to object: object to processing based on legitimate interests or for direct marketing purposes.
- Rights related to automated decision-making: GuideUp does not make solely automated decisions with legal or significant effects.
- Right to withdraw consent: withdraw any previously given consent at any time, without affecting the lawfulness of prior processing.
To exercise any of these rights, email legal@guideup.co. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority (e.g., the supervisory authority in the EU member state where you reside or work).
10. Security Measures
We implement industry-standard technical and organisational security measures to protect your personal data against unauthorised access, loss, or disclosure. These include encryption in transit (TLS), encryption at rest, access controls and authentication requirements, regular security reviews, and secure software development practices. In the event of a personal data breach that poses a risk to your rights, we will notify the relevant supervisory authority within 72 hours and affected individuals without undue delay.
11. Cookies
We use cookies and similar technologies on our website. For a full explanation of what cookies we use and how to manage them, please see our Cookie Policy.
12. Children's Privacy
GuideUp is a B2B platform intended for business users aged 18 and over. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have inadvertently collected such data, please contact us immediately at legal@guideup.co.
13. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify registered users by email and update the "Last Updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of the platform after changes take effect constitutes acceptance of the revised policy.
14. Contact
For any questions about this Privacy Policy, to exercise your data rights, or to raise a concern about how we handle personal data, please contact:
GuideUp Technologies Private Limited
Email: legal@guideup.co