Privacy Policy

Hamilton & Chase Tours ("we", "us", "our") respects your privacy and is committed to protecting your personal information. This Privacy Policy describes the categories of personal data we collect, how we use and share it, the legal bases on which we rely, the international transfers we make, and the rights available to you depending on where you live. It applies to our website, our enquiry and booking processes, our newsletter, and any other services we provide.

Specific notices for residents of the European Economic Area, the United Kingdom, California, and other US states with comprehensive privacy laws appear in Section 12.

1. Who We Are (Data Controllers)

Hamilton & Chase Tours operates through two affiliated legal entities. The entity that acts as the data controller for your personal data depends on your country of residence at the time you engage with us:

• For EU/EEA and UK residents: MB Hamilton & Chase, Konstitucijos st. 21, Vilnius 09306, Lithuania.
• For United States and other residents: Hamilton & Chase Tours LLC, 153 West 27th Street, New York, NY 10001, United States.

For any privacy enquiry — including data subject access requests, deletion requests, and complaints — write to explore@hamiltonandchase.com with the subject line "Privacy Request". We do not currently maintain a separate Data Protection Officer; privacy enquiries are handled by our operations team and routed to qualified counsel where required.

2. Scope of This Policy

This Policy covers personal data we process about:

• Visitors to our website and the forms hosted on it (trip enquiries, contact, newsletter sign-up).
• Travelers who book a tour with us and the additional travelers in their party.
• Job applicants who contact us through the careers page.
• Business and corporate clients engaging us for group or corporate travel.

It does not cover third-party websites we may link to, which have their own privacy practices.

3. Personal Data We Collect

3.1 Information you provide directly

• Identifiers and contact details: name, email address, phone number, and country of residence — submitted through our enquiry, contact, and newsletter forms.
• Trip planning information: preferred destinations, travel dates, party size, budget range, special interests, and any context you choose to share so we can tailor a quote.
• Booking and traveler information: after a booking is confirmed, we collect (separately, outside the public website) full passport details, dates of birth, dietary requirements, accessibility needs, emergency contacts, frequent traveler numbers, and similar information needed to operate your itinerary.
• Payment information: when you pay a deposit or balance, payment card details are collected and processed by our payment processor; we do not store full card numbers on our systems.
• Correspondence: emails, chat messages, voice messages, and any other communications you send us.
• Career enquiries: CVs, cover letters, and any supporting information you submit through the careers page.

3.2 Information collected automatically

• Server logs: IP address, approximate location derived from IP, browser type and version, operating system, referring URL, pages visited, and timestamps. Retained for up to 90 days for security, fraud prevention, and performance purposes.
• Cookies and similar technologies: as detailed in Section 6 below. Non-essential cookies are loaded only after you grant consent through our cookie banner.
• Analytics data: if you consent to analytics cookies, we collect aggregated information about how visitors interact with the site (page views, session duration, device category, traffic source). We use Google Consent Mode v2, which means analytics signals are anonymized and limited until consent is granted.

3.3 Information from third parties

• Tour suppliers: hotels, ground operators, and guides may share information with us about traveler preferences or incidents that occurred during your trip.
• Referral partners: if you reach us through a partner travel advisor, that partner may share your contact details with your permission.
• Public sources: we may use publicly available information (e.g. company websites for corporate clients) to verify enquiries.

3.4 Sensitive personal data

We process limited categories of sensitive data only when strictly necessary: passport numbers and government-issued identifiers (for travel arrangements), dietary information that may reveal religious belief, and accessibility information that may reveal health data. We do not process this information unless you provide it for the purpose of operating your trip, and we do not use it for any other purpose.

4. How We Use Your Personal Data

We process personal data for the following purposes:

• Responding to enquiries and providing quotes — so a destination specialist can prepare a tailored proposal.
• Operating booked tours — booking accommodation, transport, guides, restaurants, activities; communicating with suppliers; coordinating logistics; managing changes; handling emergencies on the ground.
• Processing payments and complying with financial recordkeeping obligations — including tax, accounting, and anti-money-laundering requirements.
• Sending the newsletter ("Postcards from the Road") to subscribers, with one-click unsubscribe in every email.
• Customer service and complaints — investigating issues you raise and responding within the timelines stated in our Terms & Conditions.
• Improving our website and services — understanding which content visitors find valuable, fixing bugs, and prioritizing roadmap items, using consented analytics where applicable.
• Marketing and remarketing — where you have given consent (or, in jurisdictions where it is permitted, on a soft opt-in basis for similar services), we may show you targeted advertising on third-party platforms based on your prior interactions with our site. You can opt out at any time.
• Recruitment — assessing applications, conducting interviews, and making hiring decisions.
• Security, fraud prevention, and protection of legal rights — including investigating misuse of our website or services and defending claims.
• Compliance with legal obligations — responding to lawful requests from regulators, courts, or law enforcement.

5. Legal Bases for Processing (GDPR / UK GDPR)

For residents of the EU/EEA and the UK, we rely on the following lawful bases under Article 6 of the GDPR (and the equivalent UK GDPR provisions):

Activity	Lawful basis
Responding to enquiries; providing quotes	Article 6(1)(b) — steps prior to entering a contract; or Article 6(1)(f) — legitimate interests in operating our business
Operating a booked tour	Article 6(1)(b) — performance of a contract
Processing passport and accessibility data	Article 6(1)(b) — performance of contract; Article 9(2)(a) — explicit consent for special categories where applicable
Financial and tax recordkeeping	Article 6(1)(c) — legal obligation
Newsletter and marketing communications	Article 6(1)(a) — consent (you may withdraw at any time)
Analytics and advertising cookies	Article 6(1)(a) — consent given through the cookie banner
Security, fraud prevention, defence of legal claims	Article 6(1)(f) — legitimate interests

Where we rely on legitimate interests, we have balanced our interests against your rights and freedoms. You can object to such processing at any time (see Section 10).

6. Cookies and Similar Tracking Technologies

A cookie is a small text file stored on your device when you visit a website. We use cookies and similar technologies (pixels, local storage, server-side tags) for several purposes. The first time you visit our site you will see a cookie banner that lets you grant or refuse consent for non-essential categories.

6.1 Categories of cookies we may use

• Strictly necessary — required to operate the site (e.g. remembering your cookie preferences, security tokens). These do not require consent.
• Analytics — Google Analytics 4 (via Google Tag Manager where deployed) and Microsoft Clarity, used to understand site usage in aggregate. Loaded only with consent.
• Advertising and conversion tracking — Google Ads conversion tracking and Meta (Facebook/Instagram) Pixel, used to measure the performance of our advertising campaigns and, in some cases, to show relevant ads on other platforms. Loaded only with consent.

6.2 Google Consent Mode v2

We implement Google Consent Mode v2. Until you grant consent, Google tags either do not fire at all or operate in a limited, anonymized "consent-denied" mode that does not set advertising cookies and does not collect personal identifiers.

6.3 Global Privacy Control (GPC)

We treat valid Global Privacy Control signals from your browser as a request to opt out of the "sale" or "sharing" of personal information for cross-context behavioral advertising under California and other US state privacy laws.

6.4 Managing your preferences

You can change or withdraw your cookie consent at any time by clicking the "Cookie preferences" link in the footer of any page. You can also block or delete cookies through your browser settings — note that doing so may impact the functionality of the site.

7. How We Share Your Personal Data

We do not sell your personal data in the conventional sense. We share it only as described below.

7.1 Service providers (processors)

• Tour suppliers — hotels, transport companies, guides, restaurants, and ground operators, strictly as needed to deliver your booked itinerary.
• Lead capture and storage — enquiry, contact, careers, and newsletter form submissions are sent to our own admin panel where they are stored alongside attribution data (UTM parameters, referrer, landing page) so a travel specialist can follow up. The admin panel is hosted in the United States and the European Union.
• Outbound email — replies sent from the admin panel are dispatched via Resend (Sequence, Inc., USA) using a verified hamiltonandchase.com sender address.
• Email and productivity — Google Workspace (Google LLC, USA) for email, calendar, and document storage.
• Hosting and content delivery — the public website is hosted on Cloudflare Pages (Cloudflare, Inc., USA), with image assets in Cloudflare R2. The internal admin panel is hosted on Vercel Inc. (USA).
• Analytics — Google LLC (USA) for Google Analytics 4 and Microsoft Corporation (USA) for Clarity, where consented.
• Advertising — Google LLC (USA) for Google Ads and Meta Platforms Inc. (USA) for the Meta Pixel, where consented.
• Payment processing — our payment processor handles your card details under PCI DSS standards.
• Professional advisers — accountants, auditors, and lawyers, under duties of confidentiality.

7.2 Sharing required by law or to protect rights

We may disclose personal data to comply with a legal obligation, to respond to a subpoena, court order, or other lawful request from a public authority, to enforce our Terms & Conditions, or to protect the rights, property, or safety of Hamilton & Chase Tours, our travelers, our staff, or others.

7.3 Business transfers

If we are involved in a merger, acquisition, financing, or sale of assets, personal data may be transferred as part of that transaction. We will notify you of any change of control that affects your personal data.

7.4 "Sale" or "sharing" under US state privacy laws

Some US state privacy laws define "sale" and "sharing" broadly. The use of advertising cookies (Google Ads, Meta Pixel) for cross-context behavioral advertising may qualify as a "sale" or "sharing" of personal information under California, Colorado, Connecticut, and similar laws. You have the right to opt out (see Section 12). We treat valid Global Privacy Control signals as an opt-out.

8. International Data Transfers

We are an international travel business. Personal data is necessarily transferred between the EU/EEA, the UK, the United States, and the destination countries where your tour takes place.

For transfers from the EU/EEA or the UK to countries that have not received an adequacy decision from the European Commission or the UK Information Commissioner's Office, we rely on appropriate safeguards under Article 46 of the GDPR, including:

• The European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum);
• Self-certification under the EU-US Data Privacy Framework (and its UK Extension and Swiss-US Framework) where the receiving party is certified;
• Supplementary measures, such as encryption in transit and at rest, where the destination country's surveillance laws warrant additional protection.

A copy of the safeguards we use is available on request to explore@hamiltonandchase.com.

9. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including any legal, accounting, or reporting requirements:

• Enquiries that do not become bookings: up to 3 years from last contact.
• Booked tour records and traveler information: 7 years from the end of the tour, to comply with tax and accounting laws.
• Payment and financial records: 7 years (US/UK statutory minimum) or longer where local law requires.
• Newsletter subscribers: until you unsubscribe, after which we retain your email on a suppression list to honor your opt-out.
• Server logs: up to 90 days.
• Job applications: 12 months after the recruitment decision (with your consent we may keep them longer for future opportunities).
• Cookies: see lifetimes in the cookie preference panel.

When the retention period ends, personal data is deleted or irreversibly anonymized.

10. Your Rights

Depending on your country of residence, you may have some or all of the following rights:

• Right to know / right of access — confirm whether we process your personal data and obtain a copy.
• Right to rectification / correction — ask us to correct inaccurate or incomplete data.
• Right to erasure / deletion — request that we delete your personal data, subject to certain exceptions (e.g. where retention is required by law).
• Right to restrict processing — ask us to pause processing while a dispute is resolved.
• Right to data portability — receive your personal data in a structured, commonly used, machine-readable format.
• Right to object — object to processing based on legitimate interests, including profiling and direct marketing.
• Right to withdraw consent — withdraw any consent you have given (e.g. newsletter, cookies), without affecting the lawfulness of prior processing.
• Right to opt out of "sale" or "sharing" for cross-context behavioral advertising (US state laws).
• Right to limit use of sensitive personal information (California).
• Right to non-discrimination — we will not deny you our services, charge you a different price, or provide a different level of service because you exercised a privacy right.
• Right to appeal — if we deny your request, you may appeal by replying to our response email; we will respond within 60 days. In some US states (e.g. Virginia, Colorado, Connecticut) you may then contact your state Attorney General if you remain dissatisfied.
• Right not to be subject to solely automated decisions producing legal or similarly significant effects. We do not currently make any such decisions about our travelers.

10.1 How to exercise your rights

Email explore@hamiltonandchase.com with the subject line "Privacy Request", telling us which right you wish to exercise. We may need to verify your identity before responding (typically by confirming details we already hold). We will respond within:

• 30 days for GDPR / UK GDPR requests (extendable by up to 60 days for complex requests, with notice);
• 45 days for CCPA/CPRA requests (extendable by up to 45 additional days, with notice);
• 45 days for most other US state law requests, with the right to extend by 45 days.

You may use an authorized agent to submit a request on your behalf, provided you give the agent written permission and we can verify the agent's authority.

11. Security

We protect personal data with technical and organisational measures appropriate to the risk, including HTTPS encryption for data in transit, access controls limiting personal data to staff who need it, encrypted device storage, regular software updates, and supplier due-diligence. No system is perfectly secure; if you believe your personal data has been compromised, please contact us immediately at explore@hamiltonandchase.com.

12. Regional Notices

12.1 Notice for EU/EEA and UK Residents

In addition to the rights listed in Section 10, you have the right to lodge a complaint with a supervisory authority. For EU residents this is your local data protection authority (a list is available on the European Data Protection Board's website). For Lithuania (where MB Hamilton & Chase is established), the supervisory authority is the State Data Protection Inspectorate (vdai.lrv.lt). For UK residents, the supervisory authority is the Information Commissioner's Office (ico.org.uk).

12.2 Notice for California Residents (CCPA / CPRA)

The following table sets out the categories of personal information (as defined in the California Consumer Privacy Act) we have collected, disclosed for a business purpose, and the parties to whom we disclosed it, in the 12 months preceding the date of this Policy:

Category	Collected?	Sold or shared?	Disclosed for business purpose to
A. Identifiers (name, email, phone, IP address)	Yes	Yes (advertising cookies, where consented)	Service providers; advertising partners; tour suppliers
B. Customer records (Cal. Civ. Code §1798.80 — name, contact, payment info)	Yes	No	Service providers; tour suppliers; payment processor
C. Protected classifications (e.g. age, where voluntarily provided)	Yes	No	Tour suppliers (only as needed)
D. Commercial information (services purchased)	Yes	No	Service providers; accountants
E. Internet/network activity (browsing on our site)	Yes	Yes (analytics & advertising cookies, where consented)	Analytics and advertising service providers
F. Geolocation data (general, derived from IP)	Yes	No	Service providers
G. Sensory data (audio in voice messages)	Only if you send us a voice message	No	None
H. Professional or employment information (career applicants)	Yes (applicants only)	No	None
I. Inferences drawn from the above	Yes	No	Service providers
J. Sensitive personal information (passport, dietary & accessibility)	Yes (booked travelers only)	No	Tour suppliers (only as needed)

Sources of personal information: directly from you; from your party leader if you are a co-traveler; from third parties such as referral partners and tour suppliers; automatically through cookies and server logs.

Business or commercial purposes for collection: the purposes set out in Section 4 above.

Sensitive personal information: we use sensitive personal information only for the purposes permitted under Cal. Civ. Code §1798.121(a) — i.e. providing the services you requested. We do not use it to infer characteristics about you. You have the right to limit our use of sensitive personal information by emailing explore@hamiltonandchase.com.

Right to opt out of "sale" or "sharing": you can exercise this right at any time by clicking the "Do Not Sell or Share My Personal Information" link in the footer of any page, by adjusting your cookie preferences, or by enabling the Global Privacy Control signal in your browser. We honor valid GPC signals automatically.

Shine the Light (Cal. Civ. Code §1798.83): California residents may request a notice describing what categories of personal information we share with third parties for those third parties' direct marketing purposes. We do not currently share personal information with third parties for their direct marketing.

Notice of financial incentive: we do not offer financial incentives in exchange for personal information.

12.3 Notice for Other US State Residents

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Tennessee, Iowa, Indiana, Florida, Delaware, New Hampshire, New Jersey, Maryland, Minnesota, Rhode Island, Kentucky, and Nebraska have rights similar to those described in Section 10, including the rights of access, correction, deletion, portability, and to opt out of targeted advertising, sale of personal data, and certain types of profiling. To exercise these rights, follow the procedure in Section 10.1. If we deny your request and you wish to appeal, reply to our response email within 60 days; if you remain dissatisfied after appeal, you may contact your state Attorney General.

12.4 Notice for Nevada Residents

Under Nevada Revised Statutes Chapter 603A, Nevada residents may direct us not to make any sale of their personal information. We do not currently sell personal information as defined under Nevada law. If we change this practice, you will be able to opt out by emailing us.

13. Children's Privacy

Our services are not directed to children under the age of 16, and we do not knowingly collect personal information from children under 13 (US) or 16 (EU/UK) without verifiable parental consent, in line with the Children's Online Privacy Protection Act (COPPA) and the GDPR. Where families travel with children, we collect minimal information about minors (name, age, dietary needs) only as needed to operate the trip, and only from the booking parent or guardian. If you believe we have collected information from a child without appropriate consent, please contact us and we will delete it promptly.

14. Automated Decision-Making

We do not make decisions producing legal or similarly significant effects about you based solely on automated processing.

15. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of those sites. Please review their privacy notices before submitting personal data.

16. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. The "Last updated" date at the top of this page reflects the most recent revision. Material changes will be communicated by a prominent notice on the website and, where appropriate, by email to affected individuals. Continued use of our website or services after the effective date of any update constitutes your acknowledgement of the revised Policy, except where consent is required, in which case we will seek renewed consent.

17. How to Contact Us

For any questions, requests, or complaints about this Policy or our handling of your personal data, contact:

• Email: explore@hamiltonandchase.com (subject line: "Privacy Request")
• Post (EU/UK residents): MB Hamilton & Chase, Konstitucijos st. 21, Vilnius 09306, Lithuania
• Post (US residents): Hamilton & Chase Tours LLC, 153 West 27th Street, New York, NY 10001, United States