Privacy Policy

1. Information We Collect

We collect information you provide directly to us, such as when you create an account, use our services, make a booking, or contact us for support.

2. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), UK, and other jurisdictions requiring a lawful basis, we process your personal data based on:

• Contract Performance: Processing necessary to fulfill bookings and provide our services
• Legitimate Interests: Improving our services, fraud prevention, security, and marketing (where appropriate)
• Consent: Where you have given explicit consent (e.g., marketing emails, location tracking)
• Legal Obligation: Processing required to comply with applicable laws and regulations

You may withdraw consent at any time without affecting the lawfulness of processing based on consent before withdrawal.

3. How We Use Your Information

We use the information we collect for the following purposes:

4. AI and Automated Decision-Making

SlowBoat uses artificial intelligence to enhance your travel planning experience. Here is how we use AI:

• Recommendation Engine: Our AI analyzes your search patterns, saved favorites, and stated preferences to suggest relevant tours and activities
• Chat Assistant: Our conversational AI provides travel advice, answers questions, and helps compare options
• Price Comparison: Automated systems aggregate and compare prices from multiple booking platforms
• Content Personalization: AI determines which content to display based on your interests and behavior

Important: Our AI systems assist with recommendations but do not make binding decisions about you. Final booking decisions are always yours. You have the right to request human review of any AI-assisted recommendation.

We do not use fully automated decision-making that produces legal or similarly significant effects without human oversight.

5. Information Sharing and Disclosure

We share your information in the following circumstances:

6. Data Retention

We do not sell your personal information to third parties for their marketing purposes.

We retain your personal information for as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required by law.

• Account data: Retained while your account is active and for 3 years after account deletion (for legal compliance)
• Booking records: Retained for 7 years for tax and legal purposes
• Support communications: Retained for 3 years after resolution
• Usage analytics: Aggregated and anonymized after 26 months
• Marketing preferences: Until you unsubscribe or withdraw consent
• AI training data: Anonymized interaction data may be retained indefinitely for model improvement

You can request deletion of your data at any time, subject to our legal retention obligations.

7. International Data Transfers

SlowBoat is based in Australia, and your information may be transferred to and processed in countries other than your country of residence, including:

• Australia (primary data storage)
• United States (cloud infrastructure providers)
• European Union (booking partners and service providers)
• Asia-Pacific region (regional booking platforms like Klook)

For transfers from the EEA/UK, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions where applicable
• Binding Corporate Rules for certain service providers

We ensure all transfers comply with applicable data protection laws and that your data receives equivalent protection.

8. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your experience, analyze usage, and personalize content.

• Essential cookies: Required for platform functionality (authentication, security, preferences)
• Analytics cookies: Help us understand how visitors use our site (e.g., Google Analytics)
• Personalization cookies: Remember your preferences and enable AI recommendations
• Marketing cookies: Used for relevant advertising (only with your consent)

You can manage cookie preferences through your browser settings or our cookie consent tool. Disabling certain cookies may affect platform functionality.

For detailed information about our cookie practices, please see our dedicated Cookie Policy.

9. Your Privacy Rights

Depending on your location, you have certain rights regarding your personal information:

10. Data Security

We implement robust technical and organizational measures to protect your personal information:

• Encryption: TLS/SSL encryption for data in transit; AES-256 encryption for data at rest
• Access controls: Role-based access, multi-factor authentication, and audit logging
• Infrastructure: Secure cloud hosting with SOC 2 Type II certified providers
• Monitoring: Continuous security monitoring and intrusion detection
• Training: Regular security awareness training for all team members
• Incident response: Documented procedures for security incident handling

While we strive to protect your information, no system is completely secure. If you believe your account has been compromised, please contact us immediately.

11. Children's Privacy

Our services are not intended for children under 16 years of age (or under 13 in jurisdictions where that is the applicable age). We do not knowingly collect personal information from children.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately. We will take steps to delete such information from our systems.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

• Material changes will be notified via email or prominent notice on our platform
• The "Last Updated" date at the top indicates when the policy was last revised
• Continued use of our services after changes constitutes acceptance of the updated policy

We encourage you to review this policy periodically to stay informed about our data practices.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: service@slowboat.com.au
• Address: Melbourne, Victoria, Australia
• Response time: Within 30 days (or sooner as required by applicable law)

For EEA/UK residents: You may also contact your local data protection authority if you have concerns about our data practices.

For Australian residents: You may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.