Ecuador Travel Expert
Privacy policy
Last updated: May 17th, 2026
This privacy policy explains how Viaaza B.V. (“Viaaza”, “we”, “us”) collects, uses and protects your personal data when you visit our website, contact us, subscribe to our newsletter or book a tour. We process personal data in accordance with the EU General Data Protection Regulation 2016/679 (GDPR) and the Dutch implementation thereof (UAVG).
We aim to be transparent about what we do with your data. If anything in this policy is unclear, please contact us using the details below.
Who we are
The data controller responsible for your personal data is:
Viaaza B.V.
Copierlaan 29, 4143 GC Leerdam, The Netherlands
Chamber of Commerce (KvK) number: 98030701
Email: [email protected]
We have not appointed a Data Protection Officer; we are not legally required to do so under GDPR Article 37.
What data we collect
Depending on how you interact with us, we may collect the following categories of personal data:
Contact data
Name, email address, phone number and the content of any message you send us through our contact form, email or telephone.
Newsletter data
Email address and, where you choose to provide it, your name.
Booking data
Full name, email, phone number, billing address, travel preferences and any information you provide as part of a tour booking. Payment data is processed by our payment provider; we do not store full card numbers ourselves.
Technical data
IP address, browser type and version, device type, language settings, the pages you visit on our website and the date and time of your visit. This data is collected automatically when you use our website.
Why we use your data and our legal basis
We only process personal data where we have a lawful basis under GDPR Article 6. The bases we rely on are:
To respond to your enquiry (Article 6(1)(b) and 6(1)(f))
When you contact us via the contact form, email or phone, we process your contact data to answer your question and, where applicable, to take steps prior to entering into a contract with you. We also have a legitimate interest in handling customer enquiries efficiently.
To send you our newsletter (Article 6(1)(a))
If you subscribe to our newsletter, we process your email address based on your consent. You can withdraw consent at any time via the unsubscribe link in every newsletter, or by contacting us. For US recipients: every commercial email we send includes Viaaza's physical postal address (Copierlaan 29, 4143 GC Leerdam, The Netherlands), an unambiguous unsubscribe mechanism and a truthful subject line, and we honour unsubscribe requests within ten business days, as required by the CAN-SPAM Act (15 U.S.C. §7704).
To deliver tours you book (Article 6(1)(b))
When you book a tour, we process your booking data because it is necessary to perform the contract between you and us, and to coordinate with the local operators delivering the tour.
To meet legal obligations (Article 6(1)(c))
We retain certain booking and accounting records for as long as Dutch tax and commercial law requires (currently seven years under the Algemene Wet inzake Rijksbelastingen).
To run and secure our website (Article 6(1)(f))
We process technical data based on our legitimate interest in operating our website, preventing fraud and abuse, and improving the service. You can object to this processing at any time (see “Your rights” below).
Who we share your data with
We do not sell your personal data. We share it only with the following categories of recipients, and only to the extent necessary:
- Service providers acting as our processors, such as our website hosting provider, email delivery provider, customer relationship management provider and (for bookings) our payment provider and the local tour operator delivering your tour. These processors are bound by written data-processing agreements and may only use your data on our instructions.
- Public authorities or law enforcement, where we are legally required to do so or to defend our legal rights.
- Professional advisers (lawyers, accountants, insurers) when strictly necessary in connection with their services to us.
International transfers
Some of our service providers may be located outside the European Economic Area (EEA), in particular in the United Kingdom and the United States. Where this is the case, we transfer your data only on the basis of a transfer mechanism recognised by GDPR Chapter V, such as an adequacy decision of the European Commission or the EU Standard Contractual Clauses combined with appropriate supplementary measures. You can request a copy of the safeguards we have put in place by contacting us.
How long we keep your data
We do not keep your personal data longer than necessary for the purposes for which it was collected:
- Contact-form messages and email correspondence: up to 24 months after the last contact, unless they relate to a booking (in which case the booking retention period applies).
- Newsletter data: until you unsubscribe or ask us to delete it.
- Booking and accounting data: seven years after the end of the financial year, as required by Dutch tax law.
- Technical/log data: up to 90 days, unless we need to retain it longer for security investigations.
How we secure your data
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, alteration or disclosure. These include encryption in transit (HTTPS), restricted access on a need-to-know basis, regular backups and ongoing review of our security practices. No system is completely secure; if a personal-data breach occurs that is likely to result in a high risk to your rights, we will notify you and the supervisory authority in accordance with Articles 33 and 34 GDPR.
Your rights
Under the GDPR you have the following rights in relation to your personal data:
- Right of access (Article 15): obtain confirmation of whether we process your data and a copy of that data.
- Right to rectification (Article 16): have inaccurate or incomplete data corrected.
- Right to erasure (Article 17): have your data deleted where one of the grounds in Article 17 applies (for example, the data is no longer necessary, or you withdraw consent).
- Right to restriction of processing (Article 18): ask us to limit how we use your data while a request or objection is being assessed.
- Right to data portability (Article 20): receive certain data you provided to us in a structured, commonly used and machine-readable format, and transmit it to another controller.
- Right to object (Article 21): object to processing based on our legitimate interests (including profiling), and to direct marketing at any time.
- Right to withdraw consent (Article 7(3)): where we rely on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before the withdrawal.
- To exercise any of these rights, please email [email protected]. We will respond within one month as required by Article 12(3); this period may be extended by two further months for complex requests.
Right to lodge a complaint
If you believe that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens (https://autoriteitpersoonsgegevens.nl). You may also complain to the supervisory authority of the EU member state where you live or work.
Your rights if you are a US resident
If you are a resident of the United States, the following additional rights and protections apply to you under your state's privacy laws (where such laws exist and apply to Viaaza's processing of your personal data):
Categories of personal information (CCPA / CPRA mapping)
For the purposes of California Civil Code §1798.140, the categories of personal information we collect map to: identifiers (name, email, phone, IP address); commercial information (booking history); internet or other electronic network activity (pages viewed, device and browser characteristics); geolocation data (approximate, from IP address); and inferences drawn from the above (for example, travel preferences). We collect this information from you directly when you contact us, subscribe to our newsletter or make a booking, and automatically when you use our website.
We do not sell or share your personal information
We do not 'sell' or 'share' personal information as those terms are defined under the California Consumer Privacy Act (CCPA), the California Privacy Rights Act (CPRA), or any other US state privacy law. We have not sold or shared personal information of any consumer, including consumers under 16, in the preceding twelve months.
Your rights under US state privacy laws
Depending on the state in which you reside, you may have some or all of the following rights: (a) the right to know what personal information we have collected about you and to receive a copy of that information; (b) the right to delete personal information we have collected from you; (c) the right to correct inaccurate personal information; (d) the right to opt out of the sale or sharing of personal information and of targeted advertising; (e) the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects; (f) the right to limit the use and disclosure of sensitive personal information; (g) the right to portability of personal information you provided to us; and (h) the right to be free from retaliation for exercising any of these rights. These rights are granted by, among others, the California CCPA/CPRA, the Virginia Consumer Data Protection Act (VCDPA), the Colorado Privacy Act (CPA), the Connecticut Data Privacy Act (CTDPA), the Utah Consumer Privacy Act (UCPA), the Texas Data Privacy and Security Act (TDPSA), the Montana Consumer Data Privacy Act (MCDPA), the Oregon Consumer Privacy Act (OCPA), and the Florida Digital Bill of Rights.
How to exercise your US-resident rights
To exercise any of the rights above, please email [email protected] from the email address associated with your booking or enquiry, or with sufficient personal information for us to match your request to our records. We will verify your identity before acting on the request, using information you have previously provided to us (for example, the email address used at booking and one item of booking detail). We respond to verifiable consumer requests within 45 calendar days as required by the CCPA, with one extension of up to 45 further days where reasonably necessary; we will inform you in advance if an extension is required. An authorised agent may submit a request on your behalf upon proof of written authorisation.
Global Privacy Control
We honour the Global Privacy Control (GPC) signal sent by your browser as a valid opt-out of any future sale or sharing of personal information and of any future targeted advertising, in accordance with the California CCPA regulations and the rules adopted under the Colorado and Connecticut laws. As noted above, we currently do not sell, share or use personal information for targeted advertising.
Right to complain to a US authority
If you are a California resident, you may file a complaint with the California Privacy Protection Agency (https://cppa.ca.gov) or with the California Attorney General. Residents of other states may file a complaint with their state Attorney General.
Is providing your data required?
Providing personal data is not a statutory obligation. However, if you do not provide the data we ask for in the contact form, newsletter sign-up or booking flow, we may not be able to answer your enquiry, send the newsletter or process your booking.
Automated decision-making and profiling
We do not subject you to decisions based solely on automated processing (including profiling) that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR.
Children
Our services are not directed at children, and the age thresholds that apply depend on where the child resides.
EU/EEA: in line with Article 8 of the GDPR and Article 5 of the Dutch UAVG, we do not knowingly process personal data of children under 16 without the consent or authorisation of the holder of parental responsibility.
United States: in line with the Children's Online Privacy Protection Act (COPPA, 15 U.S.C. §6501 et seq.), we do not knowingly collect personal data from children under 13 without verifiable parental consent. For California residents aged 13 to 15, we will not sell or share personal information without that consumer's affirmative opt-in (California Civil Code §1798.120(c)); as noted in 'Your rights if you are a US resident', we currently do not sell or share personal information at all.
If you believe we have collected data from a child in a way that does not meet the applicable threshold above, please contact us and we will delete the data.
Cookies
Our website uses cookies and similar technologies. For details about which cookies we set, why we set them and how to manage your preferences, please see our Cookie policy.
Changes to this privacy policy
We may update this privacy policy from time to time, for example to reflect changes in our processing activities or in applicable law. We will publish the updated version on this page and update the “last modified” date at the top. Where the changes are material, we will inform you by appropriate means before the new version takes effect.
Contact
If you have any questions about this privacy policy or how we handle your personal data, please contact us:
Viaaza B.V.
Copierlaan 29, 4143 GC Leerdam, The Netherlands
Email: [email protected]
What our travelers say
We learned a lot
Jonathan was the perfect guide for our walking tour of Old Town Quito. He was knowledgeable about the history and cultural stories, and guided us through the historic churches, La Ronda cobblestone streets, as well as the governmental buildings. We learned a lot!
Highly recommended
We recently spent three days on various tours with Jonathan and can't say enough about how fantastic a tour guide he was. He listened to our preferences and adjusted our tours to more align with what we wished to see and do. He was very professional, flexible, informative, and enjoyable to be around….and a great driver too !! We would highly recommend booking with Jonatan and his company. You will not be disappointed !!
Wonderful guide
Jonathan was a wonderful guide. He gave us a wonderful overview of Ecuador, its culture and people. One of our best visits guided by a knowledgeable guy who worked hard.
Follow us on
social media
