Privacy Policy & GDPR Compliance

Creative Tours is fully committed to the protection and confidentiality of personal data collected through its B2B platform pro.creative.com.cy. This privacy policy outlines how we collect, use, store and protect your personal data in accordance with the General Data Protection Regulation (EU GDPR 2016/679).

1. Data Controller

The data controller responsible for processing your personal information is:
Christophe Chaillou
Creative Tours
Archiepiskopou Makariou III 1
Mesa Geitonia 4000, Cyprus
Email: management@creative.com.cy

2. Scope of Application

This privacy policy applies exclusively to registered users of the Creative Tours B2B platform, which is restricted to licensed travel agents with validated accounts.

No access or usage is permitted without explicit account activation by Creative Tours.

3. Data Collection and Purpose

We collect only the data necessary to operate the platform, including but not limited to:

• Full name and contact details
• Company information
• IP address and timestamp of login and type of transaction
• Booking and payment activity ( credit card information are not collected, we are using JCC partner for PCI compliant payment process, all payment transaction are encrypted end to end )

Data is collected for the following purposes:

• Account verification and access control
• Booking management and operational support
• Payment security and fraud prevention
• Compliance with legal obligations

4. Transaction Security & IP Logging

To ensure the integrity and security of online transactions, and in cooperation with our PCI DSS-compliant payment partner JCC Payment Systems, we log:

• The IP address
• The timestamp
• The device/browser fingerprint

This data is stored securely and used exclusively to verify and secure payment activity.

5. Data Hosting and Storage

All data is stored on servers located within the European Union, hosted by OVH, a trusted European cloud infrastructure provider.

All data is encrypted and regularly backed up according to industry-standard security protocols.

6. Data Access and Deletion Rights

In accordance with GDPR, each user has the right to:

• Access their personal data at any time
• Request correction of inaccurate or outdated information
• Request deletion of their personal data (“right to be forgotten”)

Requests should be sent to: management@creative.com.cy
Creative Tours will respond to all such requests within 24 hours.

7. Data Retention Period

We retain personal data only for the duration necessary to fulfill contractual, legal, and operational obligations, including tax and accounting records.

Inactive accounts may be anonymized or deleted after a fixed retention period.

8. Use of Cookies

This website uses essential technical cookies for secure login and session management. No marketing or third-party tracking cookies are used without explicit consent.

9. Data Sharing

We do not sell or share your personal data with third parties, except:

• Payment service providers (JCC) for transaction validation only
• Legal authorities, when required by law

All partners are contractually bound to comply with GDPR and equivalent data protection standards.

10. Breach Notification

In the unlikely event of a data breach affecting your personal data, we will notify you and the relevant supervisory authorities within 72 hours, as required by the GDPR.

11. Final Statement

Creative Tours places data protection at the heart of its B2B services. We believe that trust begins with transparency, and we continuously update our policies and infrastructure to meet the highest standards of privacy, reliability, and security.

For any questions or requests regarding this Privacy Policy, please contact:
management@creative.com.cy