Privacy Policy

This policy applies to Attractions4Us LLC (“Attractions4Us”, “we”, “us”, “our”), which operates www.attractions4us.com. For the purposes of the GDPR and UK GDPR we are the data controller of the personal information described here.

This policy covers the personal information we handle through our website, our booking flow, job applications, and our email and telephone support. It does not cover:

• The tour operators who run your experience. Each operator is an independent business and an independent controller of the information it receives. Its own privacy policy governs what it does with that information.
• Bokun’s own relationship with you. Our booking and checkout are provided by Bokun. When you enter payment details you are entering them into Bokun’s hosted checkout, not into our systems.
• Other websites we link to, including our social media profiles and our TripAdvisor listing.

We do not operate user accounts. There is no login, no password, and no profile stored on this site.

• From you — what you type into the booking form, the planner, or an email.
• From your device automatically — server logs, and cookies you have accepted.
• From Bokun — booking confirmations, amendments, and cancellation and refund status for reservations you make through the site.
• From the operator — occasionally, where an operator needs to reschedule you or reports that an experience could not run.

When you apply through our Careers page, we collect the roles you select, your name, email, phone number, city or area where you can work, availability, language proficiency, experience, and your agreement to recruitment review and follow-up. You may also provide a start date, portfolio link, PDF résumé, and additional notes.

The form sends your application and any résumé through Amazon Web Services email delivery to the Attractions4Us hiring team. We use these details to review your application and contact you about recruitment. Submitting an application does not subscribe you to marketing. Applications become part of our recruitment email correspondence and are kept only as long as needed for recruitment and applicable record-keeping requirements.

Please do not include identification numbers, banking information, or medical records. To ask about, correct, or request deletion of your application, contact Reservations@attractions4us.com.

We use personal information for the purposes below. The third column states our lawful basis under the GDPR and UK GDPR; if you are not in the EEA, the UK or Switzerland, the purpose and the data still describe what we do.

We do not send marketing email. If that ever changes, we will ask for your consent separately and every message will carry a one-click unsubscribe.

We use a small number of cookies that are strictly necessary to make the site and the shopping cart work, and — only if you accept them — analytics and advertising cookies that are set by our booking provider’s widget. Nothing beyond the strictly necessary category is set before you choose.

Every cookie is listed by name, purpose, provider and duration in our Cookie Policy, where you can also change or withdraw your choice at any time. We honour the Global Privacy Control signal: if your browser sends one, we treat it as a refusal of analytics and advertising cookies without asking.

We disclose personal information to the following categories of recipient, for the purposes shown. We do not sell personal information, and we do not disclose it to anyone for their own independent marketing.

Our service providers act on our instructions under written terms that require them to protect the information and to use it only for the services they provide to us. Tour operators are independent controllers of the information they receive.

We are based in the United States and our hosting is in the United States. Some of our service providers, and many of the tour operators whose experiences we sell, are located outside your country. If you are in the EEA, the UK or Switzerland, that means your information will be transferred outside those areas.

Where we make such a transfer we rely on an appropriate safeguard recognised under Chapter V of the GDPR — in most cases the European Commission’s Standard Contractual Clauses (with the UK Addendum for UK transfers), or the transfer being necessary for the performance of the contract you have asked us to enter into with the operator. You may request a copy of the safeguard we rely on for a particular transfer by writing to us.

We keep personal information only as long as we need it for the purpose we collected it for, and then for as long as we are required to keep it by law. In practice:

Where we are defending or bringing a legal claim, we keep the relevant records until the matter and any appeal period is finished.

The site is served over HTTPS. Payment card data never touches our systems — it is captured in our provider’s hosted checkout. Our operational storage is private and access-controlled, and access to booking records is limited to the people who need it to run reservations and support.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach affects your personal information and the law requires it, we will notify you and the relevant regulator within the time limits that apply — 72 hours to the supervisory authority under the GDPR, and without unreasonable delay under US state breach-notification laws.

Wherever you live, you can ask us to do the following, and we will not treat you differently for asking:

• Access — get a copy of the personal information we hold about you.
• Correct — have inaccurate information fixed.
• Delete — have information erased, subject to records we must keep by law.
• Port — receive your information in a portable, machine-readable format.
• Object or restrict — object to processing based on legitimate interests, or ask us to pause it.
• Withdraw consent — for anything based on consent, including cookies, at any time.

Write to Reservations@attractions4us.com with your request and the booking reference or email address you used, so we can find your records. We will respond within 30 days (45 days for US state requests, extendable once where the law allows, and one month under the GDPR). We may need to verify your identity before we act — usually by confirming details of a booking you made. An authorised agent may make a request on your behalf with written proof of authority.

This section applies to California residents and supplements the rest of this policy under the California Consumer Privacy Act as amended by the CPRA.

If you are in the European Economic Area, the United Kingdom or Switzerland, the GDPR or UK GDPR applies to our handling of your information. Our lawful bases are set out in the table under How we use it, and our transfer safeguards under International transfers.

In addition to the rights listed above, you have the right to lodge a complaint with your local supervisory authority. In the UK that is the Information Commissioner’s Office (ico.org.uk); in the EEA it is the authority for the country where you live, work, or where the issue arose. We would ask you to raise it with us first so we have the chance to put it right.

Providing booking information is necessary to make a booking — if you do not provide it we cannot complete a reservation. Providing anything else is optional.

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws in force have rights to confirm, access, correct, delete, and obtain a copy of their personal information, and to opt out of targeted advertising, sale, and profiling with legal or similarly significant effects. We do not engage in profiling of that kind. Exercise these rights the same way — by writing to us at the address below.

Where a state gives you the right to appeal a refusal, you may appeal by replying to our decision with the word “appeal” and your reasons. We will respond in writing within 45 days, and tell you how to contact your state Attorney General if you remain dissatisfied.

Our website is intended for adults. We do not knowingly collect personal information directly from children under 13, and children cannot make a booking with us.

Bookings frequently include children as travellers. Where that is the case, the information is provided by the booking adult, not by the child, and is limited to what the operator needs to carry the party — typically the number of children and their age band, and occasionally a first name on a ticket. If you believe a child has provided us with personal information directly, contact us and we will delete it.

We do not make decisions about you by automated means that produce legal or similarly significant effects, and we do not use your personal information to train machine-learning models.

Our itinerary planner arranges experiences into a workable day using a deterministic scheduling algorithm and live availability. It does not profile you and it does not use a language model.

Experiences are supplied by independent tour operators. Once your booking is passed to an operator, that operator handles your information as an independent controller under its own privacy policy, and we are not responsible for what it does with it. The same is true of any website we link to, including our social profiles and our TripAdvisor listing.

We update this policy when our practices change or the law requires it. The effective date at the top always reflects the current version. If we make a change that materially affects how we use information we already hold about you, we will give notice on the site before it takes effect, and where the law requires it we will ask for your consent.

For any privacy question, or to exercise any right in this policy, write to us:

See also our Terms of Service and Cookie Policy.