EN
English Français Deutsch Italiano
USD
My account

Privacy policy

Last updated: 3 November 2026

This policy explains what data we collect when you use the TripToGo website and app, why we do so, who we share it with and how to exercise your rights.

1. Data controller

  • Controller: TripToGo Tunisia (TripToGo), Hammamet, Tunisia
  • Contact for your data: contact@triptogo.tn, +216 96 286 594
  • Declaration to the INPDP: Z23E
  • Representative in the European Union: TripToGo

2. Applicable law

We process your data in accordance with Tunisian Organic Law No. 2004-63 of 27 July 2004, under the supervision of the National Authority for the Protection of Personal Data (INPDP). Where we offer our services to people in the European Union, the General Data Protection Regulation (GDPR) also applies.

3. Data we collect

  • Booking: first name, surname, email, phone, country, language, activity, date, number of adults and children, extras, hotel or pick-up address, comment, promo code.
  • Payment: amount, currency, method, status, transaction reference and refund history. You enter your card numbers with the payment provider: we never have access to them.
  • Communications: cancellation or date-change requests, messages and notifications sent, customer service notes.
  • On the day: a record of your attendance when the QR code is checked.
  • Reviews: rating, comment and displayed name.
  • Newsletter: email and language.
  • Technical data: IP address, used to limit abusive attempts and for security, server logs, and the cookies and local storage described in section 9.

Health data: we do not routinely ask for it. If you tell us about a medical matter relevant to your safety, for example in the comment, you consent to our using it for that purpose only. Please give only what is strictly necessary.

Children: booking is for adults only. We record the number of children taking part, not their identity. Please do not enter names or other identifying details of a child.

4. Purposes and legal bases

  • Managing your booking, payment, voucher, pick-up and customer service: performance of the contract.
  • Sending messages about your booking (confirmation, reminder, change, review request): performance of the contract and legitimate interest.
  • Meeting our accounting, tax and legal obligations: legal obligation.
  • Securing the service and preventing fraud: legitimate interest.
  • Newsletter and commercial offers: your consent.
  • Audience measurement and advertising: your consent, given through the cookie banner.

By accepting this policy when you book, you consent to the processing needed for your booking, as required by Tunisian law. We make no automated decisions that have legal effects on you.

5. Recipients

We do not sell your data. The following have access, only as far as they need it:

  • Our team, according to their role: guides and drivers see only the bookings assigned to them.
  • Partner providers delivering your activity or transfer.
  • Payment providers, such as Konnect, Stripe or PayPal depending on the method offered.
  • Our hosting and technical tools: OVH SAS, France, and our email delivery service.
  • WhatsApp (Meta), if we write to you or you contact us through it.
  • OpenStreetMap, which receives your IP address when a map appears on an activity page.
  • Google (Analytics, Tag Manager, Ads) and Meta (Pixel): only if you have accepted them.
  • Authorities, where the law requires it.

6. Transfers outside Tunisia and the European Union

Some recipients are based outside Tunisia, or outside the European Union for people located there, notably in France, Ireland and the United States. These transfers take place under the conditions set by Tunisian law, including INPDP authorisation where required (Z23E) and, where the GDPR applies, on the basis of appropriate safeguards such as standard contractual clauses. Write to us to obtain a copy.

7. How long we keep data

  • Bookings and customer details: 3 years after your last booking.
  • Accounting records and payments: the period required by accounting and tax rules, namely 10 years.
  • Newsletter: until you unsubscribe.
  • Published reviews: while they are online, unless you ask us to remove them.
  • Sign-in attempts and sign-in links: about 2 days after they expire.
  • Security logs: 12 months.
  • Session: until you close your browser or after 4 hours of inactivity.

After these periods, data is automatically deleted or anonymised: your bookings and payments are kept only in anonymous form.

8. Your rights

At any time you may access your data and obtain a copy, have it corrected, completed or updated, object to its processing on legitimate grounds or to any direct marketing, and withdraw your consent. Where the GDPR applies, you also have the rights to erasure, restriction and portability.

Write to contact@triptogo.tn. We may ask you to prove your identity and we reply within one month. Some data must nevertheless be kept to meet our legal obligations.

You may complain to the INPDP in Tunisia or, if you are in the European Union, to the data protection authority of your country.

9. Cookies and local storage

You can change your choice at any time using the "Cookie settings" link at the bottom of each page.

  • ttg (necessary): keeps your session and secures forms. Duration: session.
  • ttg_cur (preference): remembers your chosen currency. Duration: 90 days.
  • ttg_consent (local storage, necessary): remembers your cookie choice.
  • ttg_install_seen (local storage, preference): avoids showing the app invitation again.
  • App cache (service worker): keeps the site's design and an offline page on your device. It contains neither your bookings nor your data.
  • Measurement and advertising (Google, Meta): set only if you accept. Their durations are set by those companies.

10. App

The installed app is the same service as the website. It does not access your location, contacts or camera, and does not send push notifications.

11. Direct marketing

We send commercial offers only if you have agreed, by ticking the box provided or signing up to the newsletter. You can unsubscribe at any time, free of charge and without giving a reason, using the link in each offer, the Unsubscribe page or your customer area.

12. Security

Our measures include HTTPS encryption, role-based access, staff passwords stored in hashed form, unguessable customer links, limits on attempts and a log of sensitive actions. As no system is infallible, we will inform you, and the authorities where the law requires, of any breach that puts you at risk.

13. Changes

We may update this policy, particularly if our services or the rules change. The date at the top of the page shows the latest version, and we will tell you about any significant change.