Privacy policy

Belle Mare Tours Ltd ("we", "us") is the data controller for personal data collected through Belle Mare Tours. We handle it in line with the Mauritius Data Protection Act 2017, and with the EU GDPR where it applies to visitors in the European Economic Area.

• Controller: Belle Mare Tours Ltd (BRN C09091906)
• Address: Royal Road, Belle Mare, Flacq, Mauritius
• Contact: [email protected]

We collect only what we need to take your booking and run your trip. Concretely, that is:

• Contact details — your name, email and phone number, so we can confirm and run your booking.
• Booking details — the activity, date, party size and options you choose, plus any pickup and drop-off location and custom itinerary you give us so your guide or driver can reach you.
• Payment confirmation — the amount, currency, payment status and a reference from our payment provider. We do not receive or store your full card number.
• Enquiries — if you send us an enquiry or contact us about an activity, we keep your name and the email or phone number you contacted us on, so we can reply and follow up.
• Account details — creating an account is optional. If you do, we hold your email, an optional name and phone number, and a secured password we never see in plain text (handled by our authentication provider).
• Trip planner — if you use the AI road-trip planner, your messages are sent to our AI provider to generate suggestions for that session. We don't use them to build a marketing profile of you.
• Device location — only if you choose to share it. When you tap "Use my current location" in the trip planner, your browser gives us your device's coordinates so we can fill in your pick-up point. We send them to Google to turn them into a readable address, and we keep only that address — and only if you go on to book, so your driver can find you. We don't store the raw coordinates or track where you are. Your browser controls this permission and you can withdraw it there at any time.
• Usage data — basic, mostly anonymous information about how the site is used, to keep it secure and working well. This includes the approximate country your connection comes from, which our hosting provider works out from your IP address. We use it to shape local options — for example, offering the "use my current location" shortcut only to visitors already in Mauritius.

• Take, confirm and run your booking, and send your e-voucher and trip information.
• Provide customer support and handle cancellations, reschedules and refunds.
• Keep records we are required to keep (for example, accounting and tax).
• Keep the platform secure and prevent fraud or abuse.
• Improve our activities and website. We do not use your data for automated decisions that affect you.

Depending on the purpose, we rely on one of these legal bases:

• Contract — to take and deliver the booking you ask for.
• Legal obligation — to meet accounting, tax and regulatory duties.
• Legitimate interests — to secure the platform, prevent fraud and improve our service, balanced against your privacy.
• Consent — for anything optional, such as sharing your device location; you can withdraw it at any time.

We don't sell your data. We share it only with the trusted service providers ("processors") that help us run the platform, and only as far as each one needs:

• Supabase — hosting and database for your booking, account and enquiry data.
• Resend — sends your transactional email, such as booking confirmations, vouchers and receipts.
• Peach Payments — processes your card payment. Your card details go directly to them; we only receive a confirmation.
• Google — powers maps and location search, and the AI road-trip planner. Location searches and planner messages are processed by Google to return results. If you share your device location, we send those coordinates to Google to turn them into a readable address.
• Cloudflare — hosting and content delivery (CDN) that serves the site securely and quickly.
• Guides, skippers and drivers who run your specific activity, with just the details they need to find you and deliver it.
• Authorities or professional advisers where we are legally required to, or to establish or defend legal claims.

Some of these providers process data outside Mauritius and the EU. Where that happens, we rely on appropriate safeguards — such as standard contractual clauses — so your data keeps a comparable level of protection. See International transfers below.

We keep this light. We use essential cookies and similar browser storage to keep you signed in, remember your cart, language and currency, and keep the site secure. We don't run third-party advertising trackers. This browser-stored data stays on your device and is cleared when you sign out.

For the full detail of what we store in your browser and why, see our Cookie notice.

• Paid bookings — the financial records of a paid booking (invoice, amount, reference) are kept for the period required by Mauritius tax and accounting law. After that, your personal details on those records are anonymised while the figures we're obliged to keep remain.
• Enquiries, draft bookings and your profile — non-essential data like this is kept while it's useful and is deleted when you ask us to, or when you delete your account.
• Browser-stored data — your cart and preferences live on your device, not on our servers, and clear when you sign out.

Subject to the applicable law, you can ask us to:

• Access the personal data we hold about you, and receive a copy.
• Rectify anything that is inaccurate or incomplete.
• Erase your data where we no longer need it (financial records we are legally required to keep are anonymised rather than deleted).
• Port your data — receive it in a portable, machine-readable format where that right applies.
• Object to or restrict certain uses, and withdraw any consent you gave.

Some of our providers — including Supabase, Resend, Peach Payments, Google and Cloudflare — operate outside Mauritius and the EU. Where your data is transferred abroad, we rely on appropriate safeguards, such as standard contractual clauses, so it keeps a level of protection consistent with applicable data-protection law.

The platform is intended for adults. We don't knowingly collect data from children under 18 except as part of a booking made by a supervising adult. If you believe a child has given us data directly, contact us and we'll remove it.

For any privacy question or request, contact [email protected]. If you're not satisfied with our response, you have the right to complain to the Data Protection Office of Mauritius (or, in the EEA, your local supervisory authority).