Privacy Policy
How we collect, use and protect your personal data — in line with the EU GDPR
Our privacy promise in plain words
- We collect only the data we need to answer your enquiry and run your trip.
- We never sell your data and we do not use it for advertising profiles.
- Hotels, guides and airlines in the destination receive only what they need to provide your services.
- This website uses only one essential cookie and no advertising or tracking cookies.
- You can ask us at any time to see, correct or delete your data — free of charge.
This Privacy Policy explains how Eurasia Global EU handles personal data when you visit our website, send us an enquiry, book a trip or work with us as a business partner. It is written in line with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the Estonian Personal Data Protection Act and the Estonian rules on electronic communications. We have tried to write it in plain language. If anything is unclear, just ask us.
Contents
- Who we are and how to contact us
- What personal data we collect
- Why we use your data and our legal basis
- Health, dietary and children's data
- Who we share your data with
- Transfers outside the EU/EEA
- How long we keep your data
- Your rights under the GDPR
- Cookies and third-party content on this website
- Newsletters and marketing
- How we protect your data
- Automated decisions, children and changes
- How to complain
1. Who we are and how to contact us
The controller responsible for your personal data is:
- Eurasia Global EU, registry code 17060963
- Registered address: Järve 50 A-7, 11314 Tallinn, Harju County, Estonia
- Email: info@eurasiadmc.com (please write "Privacy" in the subject line)
- Phone / WhatsApp: +372 5820 3742
We are a small company and are not legally required to appoint a Data Protection Officer. Our management is directly responsible for data protection, and every privacy request is handled by a named member of our team in Tallinn.
Our group has an operations team in Vietnam and a reservations support office in India. They work on our instructions, and we in Estonia remain responsible for your data.
2. What personal data we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Contact details | Name, email address, phone number, country code | You (enquiry form, email, phone, WhatsApp) |
| Trip details | Travel dates, destinations, number of adults and children, budget, hotel and activity preferences, special occasions | You |
| Booking data | Names of all travellers as in passport, date of birth, nationality, passport number and expiry (when needed for flights, cruises, permits or visas), flight details, room arrangements | You or the lead traveller who books for the group |
| Special requirements | Dietary needs, allergies, mobility or medical information relevant to the trip | You, only if you choose to tell us |
| Payment data | Invoice details, amounts paid, bank account name and IBAN used for transfers, refund details | You and our bank |
| Communication | Emails, messages, call notes, feedback and complaints | You |
| Technical data | IP address, browser type (user agent), the page from which you sent an enquiry, date and time | Your device, when you send a form |
| Business partner data | Name, job title, company, work email and phone of contacts at travel agencies, tour operators and suppliers | The partner or public business sources |
We do not collect payment card numbers on this website.
3. Why we use your data and our legal basis
The GDPR only allows us to use personal data when we have a legal basis. These are the purposes and the bases we rely on:
| Purpose | Legal basis (GDPR) |
|---|---|
| Answering your enquiry and preparing a quote or itinerary | Steps at your request before entering into a contract — Art. 6(1)(b) |
| Booking, organising and delivering your trip, including passing details to hotels, guides, transport and airlines | Performance of a contract — Art. 6(1)(b) |
| Invoicing, accounting and tax records | Legal obligation — Art. 6(1)(c), Estonian Accounting Act |
| Assisting you during the trip, handling emergencies, complaints and claims | Contract — Art. 6(1)(b); legitimate interest — Art. 6(1)(f); vital interests — Art. 6(1)(d) in a medical emergency |
| Protecting our website from spam and abuse (IP address, rate limiting, hidden spam field) | Legitimate interest in security — Art. 6(1)(f) |
| Anonymous website statistics without cookies (visits, pages viewed, approximate country, device type) | Legitimate interest in understanding and improving our website — Art. 6(1)(f) |
| Sending travel newsletters and offers | Your consent — Art. 6(1)(a); you can withdraw it at any time |
| Managing relationships with business partners and suppliers | Legitimate interest — Art. 6(1)(f) |
| Complying with requests from authorities (e.g. immigration, police, tax authority) | Legal obligation — Art. 6(1)(c) |
Where we rely on legitimate interest, we have weighed our interest against your rights. You can object at any time (see section 8).
If you do not give us the data needed for a booking — for example, passport details for a cruise or domestic flight — we may not be able to confirm that service.
4. Health, dietary and children's data
Information about allergies, medical conditions, mobility or dietary requirements can reveal health or religious information, which the GDPR treats as "special category" data. We only collect it if you choose to give it to us, we use it only to make your trip safe and comfortable, and we pass it only to the suppliers who need it (for example, a restaurant, cruise boat or guide). We rely on your explicit consent (Art. 9(2)(a) GDPR), which you give when you share the information for that purpose. You can withdraw consent at any time, but we may then be unable to arrange the service you need.
When you book for other people — family members, friends or colleagues — please make sure they know you are sharing their data with us and that they can read this policy. For children, the parent or legal guardian provides and is responsible for their data.
5. Who we share your data with
We share personal data only when it is necessary, and only the minimum required:
- Travel service providers who deliver your trip: hotels, cruise operators, airlines, transport companies, guides, restaurants and activity providers in Vietnam, Indonesia (Bali), Cambodia, Laos, India and transit countries.
- Our own teams in Vietnam (ground operations) and India (reservations support).
- IT and service providers working on our behalf, such as website hosting, email and office software, under data processing agreements.
- Banks and payment providers to process payments and refunds.
- Insurers, only if you ask us to help with a claim or in an emergency.
- Professional advisers such as accountants, auditors and lawyers, who are bound by confidentiality.
- Public authorities where the law requires it, for example immigration authorities or the police.
- Your tour operator or travel agency, if you booked through them, so they can serve you.
We do not sell, rent or trade personal data, and we do not share it with advertisers.
6. Transfers outside the EU/EEA
Because we organise travel in Asia, some of your data has to be sent to countries outside the European Economic Area, which may not offer the same level of data protection as the EU. We protect these transfers as follows:
- Hotels, guides, transport and other suppliers in the destination: the transfer is necessary to perform the travel contract you have asked for (Art. 49(1)(b) and (c) GDPR). We send only what each supplier needs.
- Our offices in Vietnam and India and IT providers outside the EEA: we use the European Commission's Standard Contractual Clauses (Art. 46 GDPR) and additional security measures, or rely on an adequacy decision where one exists.
You can ask us for more information about these safeguards or a copy of the relevant clauses (commercial details may be removed).
7. How long we keep your data
| Data | How long we keep it |
|---|---|
| Enquiries that do not lead to a booking (including IP address and browser data sent with the form) | 24 months after our last contact, then deleted |
| Booking files, contracts and correspondence | Until the end of the limitation period for possible claims — normally 3 years after the end of your trip |
| Invoices and accounting records | 7 years from the end of the financial year, as required by the Estonian Accounting Act |
| Passport copies and passport numbers | Deleted from our working systems within 90 days after your trip ends, unless needed for an open claim |
| Health, dietary and mobility information | Deleted within 90 days after your trip ends |
| Anonymous website statistics | 13 months, then deleted automatically |
| Newsletter subscription | Until you unsubscribe |
| Business partner contacts | For as long as the business relationship exists, then up to 3 years |
When a retention period ends, we delete or anonymise the data.
8. Your rights under the GDPR
You have the following rights, free of charge:
- Access — get a copy of the personal data we hold about you.
- Rectification — ask us to correct inaccurate or incomplete data.
- Erasure — ask us to delete your data, unless we must keep it by law (for example, accounting records).
- Restriction — ask us to limit how we use your data, for example while a correction is checked.
- Data portability — receive data you gave us in a common electronic format, or have it sent to another company.
- Objection — object to processing based on legitimate interest, and at any time to direct marketing.
- Withdraw consent — at any time, without affecting what we did before you withdrew it.
To use your rights, email info@eurasiadmc.com with "Privacy" in the subject. We may ask you to confirm your identity so we do not disclose data to the wrong person. We reply without undue delay and at the latest within one month; in complex cases this can be extended by two more months, and we will tell you why.
9. Cookies and third-party content on this website
We keep this website as private as possible. It does not use analytics, advertising or social media tracking cookies, so we do not ask you to accept them.
| Name / service | Purpose | Type | Duration |
|---|---|---|---|
| EDMCSESS (our own) | Keeps the website working securely, for example protecting forms against misuse | Strictly necessary — no consent required | Deleted when you close your browser |
Visitor statistics (without cookies)
To understand which pages are useful and improve our website, we count visits with our own privacy-friendly statistics tool, which runs on our own server. It does not use cookies or any other storage on your device and does not build a profile of you. When a page loads, your browser sends us the page address and title, the website you came from, your browser's time zone (used only to estimate the country) and the type of device and browser. To recognise several page views during the same visit, a one-way code is calculated from your IP address and browser details together with a secret key that is replaced every 24 hours. Your IP address itself is never stored, and the code cannot be traced back to you or followed from one day to the next. We see the results only as totals (for example "120 visits from Germany"), we do not share them with anyone, and they are deleted automatically after 13 months. Our own visits while logged in to the administration area are not counted. If your browser sends a "Do Not Track" or "Global Privacy Control" signal, no statistics are collected at all.
Third-party content
- Fonts: our fonts are hosted on our own server. We do not load Google Fonts, so no data is sent to Google for fonts.
- Images: some photographs are delivered from the image service of Unsplash (images.unsplash.com). To show an image, your browser connects to their servers, which necessarily receive your IP address and browser information. Unsplash does not receive your name or enquiry. Our legitimate interest is to show high-quality images quickly.
- Maps: on our Contact page we show office locations with an embedded Google Maps map provided by Google Ireland Limited. When the map loads, Google receives your IP address and may set its own cookies according to Google's privacy policy. If you prefer, you can use the written address instead of the map.
- WhatsApp, phone and social media links: no data is sent to WhatsApp (Meta), Facebook, Instagram, LinkedIn or YouTube until you click one of these links yourself. After that, the privacy policy of that service applies.
You can delete or block cookies in your browser settings at any time. Blocking our essential cookie may stop the enquiry form from working.
If we ever introduce analytics or marketing cookies, we will first ask for your consent with a clear "Accept" and "Reject" choice, and we will update this policy.
10. Newsletters and marketing
We send newsletters or offers only if you have agreed to receive them, or — for existing customers — about similar trips, with a simple way to say no every time. Every email includes an unsubscribe link, and you can also unsubscribe by writing to us. We never share your email address with other companies for their marketing.
11. How we protect your data
- The website uses an encrypted HTTPS connection.
- Enquiries are stored in a password-protected administration system that only authorised staff can access.
- Passwords are stored in encrypted (hashed) form, and access is limited on a need-to-know basis.
- Our staff and partners are bound by confidentiality.
- We use data processing agreements with our service providers.
- If a data breach is likely to put your rights at risk, we notify the Estonian Data Protection Inspectorate within 72 hours and inform you without undue delay where the law requires it.
Please send passport copies or health information only when we ask for them, and preferably not through public messaging groups.
12. Automated decisions, children and changes
- We do not make decisions about you based solely on automated processing, and we do not create profiles for advertising.
- Our website is not directed at children under 16. Bookings for children are made by a parent or guardian.
- We may update this policy when the law or our services change. The date of the latest update is shown at the bottom of this page. If changes are significant, we will inform customers with active bookings.
13. How to complain
If you are unhappy with how we handle your data, please contact us first — we will do our best to put it right quickly. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work, or where the alleged infringement took place. Our lead authority is:
- Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon)
- Tatari 39, 10134 Tallinn, Estonia
- Email: info@aki.ee · Phone: +372 627 4135
- Website: www.aki.ee
Last updated: 05 October 2026