Privacy Policy

Last updated: 10 November 2026

• Company: All Trips Tours, trading as Egypt Online Tour (tourism company licence number 1466, category A)
• Address: 68 Ahmed Elzoer St, Nasr City, Cairo, Egypt
• Email for privacy questions and requests: contact@egyptonlinetour.com
• Phone and WhatsApp: +20 127 450 3634

This policy explains how we use personal data when you visit egyptonlinetour.com, contact us or book a trip with us. It is written to meet the EU and UK General Data Protection Regulation (GDPR) and the Egyptian Personal Data Protection Law (Law No. 151 of 2020).

Where	Data	Purpose	Legal basis
Tour enquiry and customize forms	name, email, WhatsApp / phone and dial code, nationality, travel dates, travellers and children's ages, trip preferences, hotel and pick-up details, message; the language of the page; the date and version of the privacy policy you confirmed you had read	answer your request and prepare an offer	steps at your request before a contract (GDPR art. 6(1)(b))
Contact form	name, email, WhatsApp / phone and dial code, nationality, subject, message; the language of the page	answer your message	art. 6(1)(b) when your message is about a trip; otherwise our legitimate interest in answering (art. 6(1)(f))
Health or dietary needs you choose to tell us (for example mobility needs or food requirements)	only what you write in a form, email, chat or WhatsApp message	arrange a trip that suits you, and tell the hotels, cruise and transport providers that need to know	your explicit consent (GDPR art. 9(2)(a)), which you give with the checkbox under your message on our trip form, or by sending the information to us yourself; you can withdraw it at any time, but we may then not be able to arrange those services
Emails, WhatsApp messages and live chat with our team	your name, contact details and what you write to us	answer you, prepare your offer and run your booking	art. 6(1)(b), or our legitimate interest in answering (art. 6(1)(f))
Newsletter (double opt-in)	email address, sign-up source, time of consent and of confirmation, a one-way hash of the IP address	send the newsletter you asked for, and keep proof of your consent	your consent (art. 6(1)(a)); withdraw at any time with the link in every email
Bookings	the data above plus what is needed to book hotels, cruises, flights and trains (for example the names, dates of birth and passport details of the travellers), payments and the booking history	perform the contract	art. 6(1)(b)
Accounting and legal duties	booking, invoice and payment records	keep the records that Egyptian accounting, tax and tourism rules require, and answer lawful requests of authorities	legal obligation (art. 6(1)(c))
Every visit	IP address, browser data, the pages requested (server logs); spam and bot checks when you use a form	security, abuse prevention and keeping the site working	legitimate interest (art. 6(1)(f))
Analytics, marketing, chat and country detection (only after you accept them in the cookie banner)	see sections 5 and 6	measure and improve the site; measure our adverts; live chat; fill in your country in the forms	your consent (art. 6(1)(a))

We do not sell personal data. We do not ask for card numbers on this website, by email, by chat or by WhatsApp. We do not make decisions about you based only on automated processing, apart from the automatic spam check on our forms.

• Enquiries and contact messages that did not lead to a booking: deleted from the website's records 24 months after we receive them.
• Bookings: for as long as we need them to provide the trip and handle any claim, and for as long as Egyptian accounting and tax law requires us to keep the records.
• Newsletter: unconfirmed sign-ups are deleted after 30 days; the hash of the IP address is deleted 90 days after you sign up; a confirmed subscription is kept until you unsubscribe. After you unsubscribe we keep only your email address and the date you unsubscribed, so that we do not write to you again; ask us if you want it deleted completely.
• Country detection: only the country is kept, for 24 hours.
• Cookie choice: 180 days, then the banner asks again.
• Server logs: kept for a short period for security, then deleted.
• Backups: our backups also hold copies of the data above. We keep backups only as long as we need them to restore the site, and deleted data disappears from them as old backups are removed.

• Our staff who answer enquiries and run bookings, only what they need.
• Suppliers that provide your trip (hotels, cruise operators, guides, transport companies, airlines, the railway), only what they need. Many of them are in Egypt, and they use your data under their own responsibility.
• Service providers (processors) that work for us under contracts: Hostinger (the server that hosts the website and its database), our email service provider, the payment service provider that runs the secure payment link for the deposit (it receives your card details directly; we do not see your full card number), and the providers listed in sections 5 and 6.
• Public authorities, courts and our professional advisers, when the law requires it or to protect our legal rights.

The cookie banner has separate switches for "Analytics" and "Marketing". Nothing in this section loads before you choose "Accept all" or switch on the category concerned.

• Analytics: Google Tag Manager (Google Ireland Ltd / Google LLC), which loads Google Analytics 4 (visit statistics and page speed measurements), and Microsoft Clarity (Microsoft; heatmaps and session recordings of how pages are used; what you type in forms is masked).
• Marketing: the Google Ads tags in Google Tag Manager (Google): they measure which adverts brought you to the site and which enquiries came from them, and they can be used to show you our adverts on other sites (remarketing).
• Google Consent Mode v2 starts with all analytics and advertising storage denied and is updated only after your choice.
• We do not use the Meta (Facebook and Instagram), TikTok or Microsoft Advertising pixels. If we add a new provider, we list it here and the banner asks for your choice again.

• Tawk.to live chat (tawk.to inc., United States): loaded only after you switch on "Chat and country detection". What you write in the chat is stored by Tawk.to for us.
• Country detection for the forms (ipapi.co): your IP address is sent only after the same consent; only the country is kept, for 24 hours.
• Google reCAPTCHA (Google): checks that a form is sent by a person. It loads only when you start using a form and receives your IP address and data about your browser and its use. Google's Privacy Policy and Terms of Service apply.
• Google Maps (Google): the Contact page links to our office on Google Maps. Google receives data only if you open the link.
• WhatsApp (WhatsApp Ireland / Meta): if you contact us on WhatsApp, WhatsApp's own privacy policy also applies.

We are based in Egypt, so your data is processed in Egypt. Egypt has no adequacy decision from the European Commission or the United Kingdom. We send your data to Egypt only because you ask us to prepare and provide your trip there. Some of our providers (Google, Microsoft, Tawk.to, ipapi.co) process data in the United States or other countries. Google and Microsoft are certified under the EU-US Data Privacy Framework and its UK extension; for other providers we rely on the standard contractual clauses approved by the European Commission where the provider offers them. You can ask us for more information about these safeguards at the email address in section 1.

• Strictly necessary, always allowed: the session cookie and the security token that protect the forms, and the cookie that stores your cookie choice.
• Stored in your browser and never sent to us: your currency choice and the banners you closed.
• Analytics, marketing and chat cookies: set only after your consent. When you withdraw it, we stop loading these services and delete the cookies they set on our domain.

You can change your choice at any time from the "Cookie settings" link in the footer.

You can ask for access to your data, correction, deletion, restriction, objection (including to direct marketing at any time), data portability, and withdraw a consent at any time without affecting what was done before. Under the Egyptian law you also have the right to be told about a breach of your personal data. Write to the email address in section 1. We may ask you to confirm your identity before we answer. We answer within one month, free of charge.

You can complain to the data protection authority of the country where you live or work, or where you think the problem happened (in the EU/EEA: your national supervisory authority; in the UK: the Information Commissioner's Office; in Egypt: the Personal Data Protection Center established by Law No. 151 of 2020). We would appreciate the chance to answer your concern first.

We collect the categories of data described in section 2 for the purposes described there. We do not sell personal data for money. The Google Ads marketing tags (section 5) can count as "sharing" or "targeted advertising" under some US state laws; they load only if you switch on "Marketing", and you can switch them off at any time from "Cookie settings". You can ask us to access, correct or delete your data at the email address in section 1, and we will not treat you differently because you used these rights.

Our services are booked by adults. We receive children's data only from their parents or guardians: their ages to price a family trip and, for a booking, what hotels, cruises, flights and trains need.

The website uses an encrypted connection (HTTPS). Access to enquiries and bookings is limited to the staff who need it and protected by passwords, and two-step login is available for the administration area.

We publish any change on this page with a new "Last updated" date. The enquiry form records which version you confirmed you had read.