Privacy Policy

1. Information We Collect

We collect information you provide directly to us, such as when you create an account, use our services, make a booking, or contact us for support.

2. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), UK, and other jurisdictions requiring a lawful basis, we process your personal data based on:

• Contract Performance: Processing necessary to fulfill bookings and provide our services
• Legitimate Interests: Improving our services, fraud prevention, security, and marketing (where appropriate)
• Consent: Where you have given explicit consent (e.g., marketing emails, location tracking)
• Legal Obligation: Processing required to comply with applicable laws and regulations

You may withdraw consent at any time without affecting the lawfulness of processing based on consent before withdrawal.

3. How We Use Your Information

We use the information we collect for the following purposes:

4. AI and Automated Decision-Making

Slow Boat uses automated systems, including artificial intelligence, in parts of the service. Here is where:

• Recommendation Engine: Our AI analyzes your search patterns, saved favorites, and stated preferences to suggest relevant tours and activities
• Chat Assistant: Our conversational AI provides travel advice, answers questions, and helps compare options
• Price Comparison: Automated systems aggregate and compare prices from multiple booking platforms
• Content Personalization: AI determines which content to display based on your interests and behavior

Important: Our AI systems assist with recommendations but do not make binding decisions about you. Final booking decisions are always yours. You have the right to request human review of any AI-assisted recommendation.

We do not use fully automated decision-making that produces legal or similarly significant effects without human oversight.

5. Information Sharing and Disclosure

We share your information in the following circumstances:

6. Data Retention

We do not sell your personal information to third parties for their marketing purposes.

We retain your personal information for as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required by law.

• Account data: Retained while your account is active and for 3 years after account deletion (for legal compliance)
• Booking records: Retained for 7 years for tax and legal purposes
• Support communications: Retained for 3 years after resolution
• Usage analytics: Aggregated and anonymized after 26 months
• Marketing preferences: Until you unsubscribe or withdraw consent
• AI training data: Anonymized interaction data may be retained indefinitely for model improvement

You can request deletion of your data at any time, subject to our legal retention obligations.

7. International Data Transfers

Slow Boat is based in Australia, and your information may be transferred to and processed in countries other than your country of residence, including:

• Australia (primary data storage)
• United States (cloud infrastructure providers)
• European Union (booking partners and service providers)
• Asia-Pacific region (regional booking platforms like Klook)

For transfers from the EEA/UK, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions where applicable
• Binding Corporate Rules for certain service providers

We ensure all transfers comply with applicable data protection laws and that your data receives equivalent protection.

8. Cookies and Tracking Technologies

We store a small amount of data in your browser, and two third-party services can run on this site. The chooser in the footer offers exactly the three categories below — see the Cookie Policy for the full detail.

• Essential (no choice offered): your signed-in session, a session identifier, and the currency and language you picked. Stored in your browser, never shared, and required for the site to work at all.
• Measurement (off until you allow it): Cloudflare Web Analytics — page speed and traffic volume. It sets no cookie and does not follow you to other sites.
• Partner content and attribution (off until you allow it): GetYourGuide. This credits us for bookings you make after following a link from here, and it renders their activity panels on destination pages. Refusing hides those panels.
• We do not use Google Analytics, Vercel Analytics, or any advertising network, and we run no advertising cookies.

You can manage tracking preferences at any time through "Cookie preferences" in the footer of any page, or through your browser settings. Nothing outside the essential category loads until you allow it, and refusing is one click. Blocking storage entirely will stop you staying signed in.

For detailed information about our cookie practices, please see our dedicated Cookie Policy.

9. Your Privacy Rights

Depending on your location, you have certain rights regarding your personal information:

10. Data Security

We implement robust technical and organizational measures to protect your personal information:

• Encryption: TLS/SSL encryption for data in transit; AES-256 encryption for data at rest
• Access controls: Role-based access, multi-factor authentication, and audit logging
• Infrastructure: Secure cloud hosting with SOC 2 Type II certified providers
• Monitoring: Continuous security monitoring and intrusion detection
• Training: Regular security awareness training for all team members
• Incident response: Documented procedures for security incident handling

While we strive to protect your information, no system is completely secure. If you believe your account has been compromised, please contact us immediately.

11. Children's Privacy

Our services are not intended for children under 16 years of age (or under 13 in jurisdictions where that is the applicable age). We do not knowingly collect personal information from children.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately. We will take steps to delete such information from our systems.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

• Material changes will be notified via email or prominent notice on our platform
• The "Last Updated" date at the top indicates when the policy was last revised
• Continued use of our services after changes constitutes acceptance of the updated policy

We encourage you to review this policy periodically to stay informed about our data practices.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: service@slowboat.com.au
• Entity: Slow Boat Pty Ltd (ABN 59 621 282 175)
• Address: Shop 4/198 Harbour Esplanade, Docklands, Victoria 3008, Australia
• Response time: Within 30 days (or sooner as required by applicable law)

For EEA/UK residents: You may also contact your local data protection authority if you have concerns about our data practices.

For Australian residents: You may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.