Privacy Policy

Important: This document is boilerplate and does not constitute legal advice. You should have it reviewed by a qualified lawyer before relying on it, especially regarding GDPR compliance in Malta.

1. Introduction

CET Leisure Ltd ("we", "us", or "our") operates GuideBook.mt (the "Platform"). This Privacy Policy explains how we collect, use, disclose, and protect personal data when you visit our website or use our services.

We are the data controller for personal data processed through the Platform. If you have questions, contact us at privacy@guidebook.mt.

2. Who This Policy Applies To

This policy applies to:

• Guides (Professional Licensed Tour Guides)
• Agents (Licensed Travel and Tourism Agents and agency staff)
• Visitors to our public website
• Platform administrators

3. Personal Data We Collect

3.1 Information you provide

• Account data: name, email address, password (stored in hashed form), role (Guide or Agent), professional registration number
• Agency data: agency name and registration number (for Agents)
• Profile data: phone number, address, biography, profile photo, languages, tour types, pricing, video links, and other information you choose to add
• Booking data: booking requests, dates, tour details, status, notes, and messages exchanged in connection with bookings
• Communications: messages you send through the Platform and correspondence with our support team
• Calendar integration data: if you connect Google Calendar or upload ICS files, we may store calendar sync settings, tokens, and booking-related calendar events

3.2 Information collected automatically

• Usage data: pages visited, features used, and actions taken on the Platform
• Device and log data: IP address, browser type, operating system, and timestamps
• Cookies and session data: see Section 10

3.3 Information from third parties

• Google Calendar: if you authorise calendar sync, we receive calendar access tokens and calendar event data as permitted by your Google account settings
• Verification data: information used to verify your professional licence or agency status

We do not intentionally collect special categories of personal data (such as health or biometric data). Please do not submit such data through the Platform unless necessary and with appropriate consent.

4. How We Use Personal Data

We use personal data to:

• Create and manage your account
• Verify Guide and Agent eligibility
• Enable search, booking requests, and messaging between users
• Display profiles and availability to other authorised users
• Sync bookings with connected calendar services
• Send transactional emails (account verification, booking notifications, password resets)
• Provide customer support
• Improve, secure, and maintain the Platform
• Comply with legal obligations
• Enforce our Terms of Service

We process data on the following legal bases under the GDPR:

• Contract: to provide the Platform and services you request
• Legitimate interests: to operate, improve, and secure the Platform, and to prevent fraud or abuse
• Consent: where required (for example, optional calendar integrations or marketing communications)
• Legal obligation: where we must retain or disclose data by law

5. Google Calendar Data

What we access

If you choose to connect your Google Calendar to Guidebook Calendar Sync, we request the following permissions:

• View your list of calendars — used only to let you select which of your Google Calendars to sync with your Guidebook account. We do not read or store calendar names, settings, or sharing permissions beyond what is needed to display this selection to you.
• View and manage events on your selected Google Calendar — used to read your existing event times and to create, update, and delete events related to your bookings, as described below.

How we use this data

Reading your calendar: We periodically read events from your selected Google Calendar, approximately every 30 minutes, or immediately when you manually trigger an import. We import only the date and time interval of each event. We do not import, read, store, or display event titles, descriptions, locations, guests, or any other event content. This information is used solely to mark the corresponding time as "unavailable" on your public availability calendar, so clients cannot request bookings that conflict with your existing schedule.

Writing to your calendar: When a client confirms a booking through your Guidebook profile, we automatically create a corresponding event on your connected Google Calendar. If that booking is later rescheduled or cancelled, we update or delete the corresponding event. This synchronization is enabled by default once you connect your Google Calendar, so that your publicly displayed availability remains accurate and does not show already-booked times as open. You may disable automatic sync at any time in your account settings. We only ever modify events that Guidebook itself created — we never edit, move, or delete any pre-existing events already on your calendar.

Your control over this data

• You may disable automatic calendar sync at any time from your account settings, without disconnecting your Google account.
• You may fully disconnect your Google Calendar at any time. Disconnecting immediately revokes our access to your Google account and stops all further reading from and writing to your calendar. Disconnecting does not delete or affect any events already present on your Google Calendar, including events previously created by Guidebook.
• You may revoke Guidebook's access directly through your Google Account permissions at myaccount.google.com/permissions at any time.

Data retention

We retain only the busy/free date and time intervals derived from your Google Calendar for as long as your Google Calendar connection remains active, in order to keep your public availability calendar accurate. This data is deleted when you disconnect your Google Calendar or delete your Guidebook account. We do not retain any event titles, descriptions, or other event content, as this data is never imported in the first place.

Limited use disclosure

Guidebook Calendar Sync's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google Calendar data for advertising purposes, do not sell Google user data to third parties, and do not allow humans to read this data except: (a) with your affirmative consent, for a specific purpose you request; (b) as necessary for security purposes such as investigating abuse; (c) to comply with applicable law; or (d) as part of a merger, acquisition, or sale of assets, subject to prior notice.

6. How We Share Personal Data

We may share personal data with:

• Other Platform users: profile and booking information is visible to relevant Guides and Agents as part of normal Platform operation (for example, an Agent viewing a Guide's profile, or a Guide receiving a booking request)
• Service providers: hosting, email delivery, and infrastructure providers who process data on our behalf under data processing agreements
• Google: when you connect Google Calendar, in accordance with Google's API Services User Data Policy
• Authorities: where required by law, court order, or to protect our rights and safety

We do not sell your personal data.

7. International Transfers

Your data is primarily processed within the European Economic Area (EEA). If we transfer data outside the EEA, we will ensure appropriate safeguards are in place (such as Standard Contractual Clauses) as required by GDPR.

8. Data Retention

We retain personal data for as long as your account is active and as needed to provide the Platform. We may retain certain data longer where required by law, to resolve disputes, or to enforce our agreements.

When you delete your account, we will delete or anonymise your personal data within a reasonable period, except where retention is legally required or permitted.

9. Your Rights

Under the GDPR and Maltese data protection law, you may have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase your data ("right to be forgotten") in certain circumstances
• Restrict processing in certain circumstances
• Object to processing based on legitimate interests
• Data portability — receive your data in a structured, machine-readable format
• Withdraw consent where processing is based on consent

To exercise these rights, contact us at privacy@guidebook.mt. We will respond within one month, as required by law.

You also have the right to lodge a complaint with the Office of the Information and Data Protection Commissioner (IDPC) in Malta: https://idpc.org.mt.

10. Cookies and Similar Technologies

We use cookies and similar technologies to:

• Keep you logged in (session cookies)
• Remember your preferences
• Maintain security (CSRF protection)
• Understand how the Platform is used

Essential cookies are necessary for the Platform to function. You can control non-essential cookies through your browser settings, though disabling certain cookies may affect functionality.

11. Security

We implement appropriate technical and organisational measures to protect personal data, including encryption in transit (HTTPS), access controls, and secure password storage. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

12. Children's Privacy

The Platform is not intended for users under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

13. Third-Party Links

The Platform may contain links to third-party websites or services. We are not responsible for their privacy practices. Please review their privacy policies before providing personal data.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the revised policy on the Platform and update the "Last updated" date. Material changes may be communicated by email or through a notice on the Platform.

15. Contact Us

For privacy-related enquiries or to exercise your data protection rights:

CET Leisure Ltd
Email: privacy@guidebook.mt
Website: https://guidebook.mt

Data Protection Contact: privacy@guidebook.mt