Effective Date: October 26th, 2026
Last Updated: October 26th, 2026
Macua Tours is a registered trade name of Macua Tours Oy, a limited liability company (osakeyhtiö) organized under the laws of Finland and registered in Finland (Business ID: 3646124-7).
The company operates publicly under the name Macua Tours, also styled as Macuá Tours. These names refer to Macua Tours Oy and do not represent separate legal entities.
This Privacy Policy explains how Macua Tours Oy collects, uses, shares, stores, and protects personal information when you visit macuatours.com, contact us, request a quotation, book travel services, communicate with us through email or WhatsApp, or interact with our forms, payment platforms, and customer support channels.
Macua Tours Oy coordinates private travel services across Costa Rica and neighbouring destinations through independent local transportation providers, guides, accommodation providers, activity operators, and other travel service partners.
This Privacy Policy applies to personal information processed by Macua Tours Oy regardless of the traveller’s nationality or country of residence.
The data controller for the personal information described in this Privacy Policy is:
Legal company name: Macua Tours Oy
Business ID: 3646124-7
Country of registration: Finland
Privacy contact: [email protected]
Business address for formal notices: Sahatie 4 C 38, 01650 Vantaa, Finland.
This Privacy Policy applies to personal information collected through:
This Privacy Policy does not replace our Terms & Conditions, Booking Terms, or Cancellation Policy. Those documents govern the commercial terms of your booking.
We collect personal information only when it is relevant to communication, quote preparation, booking coordination, payment processing, customer support, legal compliance, safety, or service delivery.
1.1 Contact Information
We may collect name, email address, phone number, WhatsApp number, country of residence, billing address, and preferred communication method.
1.2 Travel and Booking Information
When you request or book travel services, we may collect travel dates, pickup and drop-off locations, lodging details, flight information, arrival and departure times, route preferences, number of passengers, passenger names, ages of minors when relevant, luggage details, surfboard or sports equipment details, special stops or route requests, and emergency contact information when voluntarily provided.
1.3 Identity and Border-Related Information
For certain cross-border transfers, Nicaragua entry support, hotel coordination, activity requirements, surf trips, or local regulatory procedures, we may need to collect passport information, date of birth, nationality, government-issued identification details, travel document information, and visa or entry-related information when required for the service.
We collect this information only when it is necessary for the specific trip, provider, border process, lodging requirement, local authority requirement, or customer-requested service.
1.4 Health, Dietary, Accessibility, and Safety Information
You may choose to provide information such as dietary restrictions, allergies, mobility needs, medical considerations relevant to travel safety, fitness level for adventure activities, surfing experience level, or accessibility requirements.
We use this information only to coordinate your trip, communicate relevant needs to local providers, reduce operational risk, and help adapt the service where reasonably possible.
1.5 PaymentandTransactionInformation
When you make a payment, we may collect or receive billing name, billing email, payment status, transaction amount, currency, invoice details, last four digits of a payment card when provided by the processor, payment confirmation records, and refund or chargeback records.
We do not store full credit card numbers on our own website servers. Card payments are processed by third-party payment providers, banks, or financial platforms. Those providers process payment data under their own privacy and security terms.
1.6 Communications
We may keep records of communications sent through email, WhatsApp, website forms, payment platform messages, customer support conversations, review communications, or testimonial communications.
1.7 Website, Device, and Analytics Information
When you visit our website, we may collect IP address, browser type, device type, pages visited, referring website, time spent on pages, approximate location based on IP address, cookie identifiers, analytics events, and technical logs.
This information helps us understand website performance, improve user experience, detect abuse, and measure marketing activity.
1.8 Marketing Preferences
If you subscribe, request updates, or agree to receive marketing communications, we may collect your preferences and communication history. You can unsubscribe from marketing emails at any time.
We use personal information for the following purposes:
Macua Tours Oy processes personal information in accordance with the EU General Data Protection Regulation (GDPR). Depending on the purpose and nature of the information, we rely on the following legal bases:
5.1. Performance of a Contract
We process personal information when necessary to respond to booking requests, prepare quotations, arrange transportation and travel services, coordinate itineraries, communicate with travellers, administer payments, and fulfil our contractual obligations.
This also includes taking steps requested by a prospective customer before entering into a contract.
5.2. Compliance with Legal Obligations
We process and retain information where necessary to comply with applicable legal, accounting, tax, financial reporting, and regulatory obligations, including lawful requests from competent authorities.
5.3. Legitimate Business Interests
We may process personal information where necessary for our legitimate interests in operating and protecting our business, including customer communications, service improvements, fraud prevention, information security, dispute resolution, and the establishment, exercise, or defence of legal claims.
We rely on this basis only where those interests are not overridden by the rights and freedoms of the individuals concerned.
5.4. Consent
Where required by law, we obtain consent before processing personal information for specific purposes, including certain marketing communications, non-essential cookies, or other activities requiring consent.
Consent may be withdrawn at any time by contacting [email protected]. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn or processing justified by another applicable legal basis.
5.5. Health, Accessibility, and Other Sensitive Information
Certain travel arrangements may require information about allergies, medical conditions, dietary requirements, mobility limitations, or other personal circumstances relevant to safety, accessibility, or service coordination.
Where such information constitutes special-category personal data under Article 9 of the GDPR, we process it only where a valid legal basis under Article 6 and an applicable exception under Article 9 are available, normally the traveller’s explicit consent for the specific purpose.
We request only information reasonably necessary for the relevant arrangements and share it with local providers only where lawful and necessary.
Providing sensitive information is generally voluntary. However, choosing not to provide certain information may limit our ability to accommodate specific accessibility, medical, dietary, or safety-related requests.
5.6. Vital Interests and Emergencies
In exceptional circumstances involving a serious threat to someone’s life or physical safety, we may process necessary personal information to protect the vital interests of that person or another individual, where the conditions established by applicable law are satisfied.
Where special-category information is involved, the additional requirements of Article 9 of the GDPR also apply.
Macua Tours Oy applies the legal basis appropriate to each processing activity and limits the collection and use of personal information to legitimate, specified, and necessary purposes.
We do not sell or rent personal information.
We share personal information only when necessary to coordinate travel services, process payments, comply with legal obligations, protect our legitimate business interests, or deliver services requested by our customers.
We limit the information shared to what is reasonably necessary for each purpose and apply the relevant data protection requirements.
6.1. Local Travel Providers
We may share necessary personal information with independent local partners in Costa Rica and neighbouring destinations, including transportation providers, drivers, guides, border support providers, accommodation providers, activity operators, surf instructors, boat operators, restaurants, local coordinators, and emergency assistance providers.
Information shared depends on the service. For example, drivers may require passenger names, pickup and drop-off locations, flight details, contact information, and luggage requirements. Hotels or providers assisting with border procedures may require passport or identification details.
Sensitive personal information is shared only when necessary and supported by an appropriate legal basis.
6.2. Payment Processors and Financial Platforms
We may share payment-related information with banks, payment processors, invoicing platforms, fraud prevention services, and other financial providers involved in processing transactions, issuing refunds, verifying payments, preventing fraud, or fulfilling financial and regulatory obligations.
6.3. Website, Hosting, Email, and Technology Providers
We may share relevant information with technology providers supporting our website, hosting, email communications, booking forms, customer relationship management, information security, storage, and customer support operations.
Such processing is subject to applicable data protection requirements, including contractual safeguards where required.
6.4. Analytics and Advertising Tools
We may use website analytics, search advertising, and social media advertising technologies to measure website performance, understand visitor interactions, and evaluate marketing campaigns.
These technologies may process information such as cookie identifiers, device information, browsing activity, and website interaction data.
Non-essential analytics and advertising cookies or comparable tracking technologies are subject to the prior consent requirements of applicable Finnish law.
Where consent is required, visitors must be able to accept or reject non-essential tracking and withdraw their consent through an accessible mechanism.
Any personal information collected through these technologies is processed in accordance with applicable data protection requirements.
6.5. Professional Advisors and Legal Compliance
We may disclose relevant personal information to accountants, legal advisors, insurers, banks, payment networks, regulatory authorities, courts, or law enforcement agencies when necessary to comply with legal obligations, respond to lawful requests, resolve disputes, investigate fraud, manage chargebacks, or establish, exercise, or defend legal claims.
6.6. Business Transfers
If Macua Tours Oy is involved in a merger, acquisition, financing arrangement, corporate restructuring, or transfer of business assets, relevant personal information may be disclosed or transferred where necessary and legally permitted.
Any such processing will be subject to applicable GDPR requirements, including appropriate safeguards and transparency obligations.
Macua Tours Oy is established in Finland and coordinates travel services for international travellers in Costa Rica and neighbouring destinations.
To prepare quotations, arrange bookings, coordinate transportation, accommodation, tours, and other travel services, it may be necessary to share personal information with independent local providers operating outside the European Economic Area (EEA).
Such information may include traveller names, contact details, travel dates, accommodation information, transportation arrangements, passport or identification details where required, and other information necessary to deliver the requested services.
7.1. Compliance with GDPR
International transfers of personal information are subject to Chapter V of the EU General Data Protection Regulation (GDPR), regardless of the traveller’s nationality or country of residence.
Macua Tours Oy is responsible for ensuring that transfers of personal information outside the EEA have an appropriate legal basis and comply with applicable GDPR requirements.
7.2. Legal Mechanisms for International Transfers
Depending on the recipient, destination, and purpose of the transfer, personal information may be transferred where:
The European Commission has recognised the destination as providing an adequate level of data protection.
Appropriate safeguards have been established, such as the European Commission’s Standard Contractual Clauses (SCCs), together with any additional measures required by law.
A specific exception under Article 49 of the GDPR applies, including certain occasional transfers that are objectively necessary to perform a travel contract or arrange services requested by the traveller.
These exceptions are applied only where their legal requirements are satisfied and do not constitute general authorisation for unrestricted international transfers.
7.3. Data Minimisation and Provider Access
Macua Tours Oy limits the personal information shared with international providers to what is reasonably necessary for the relevant service.
For example, a transportation provider may require passenger names, pickup details, and contact information, while an accommodation provider or border-related service provider may require additional identification or travel document details.
Sensitive personal information is shared only where necessary and supported by the legal conditions applicable to its processing and international transfer.
7.4. Transparency and Your Rights
Travellers may contact Macua Tours Oy to request information about the international transfer mechanisms and safeguards applicable to their personal information, including how to obtain relevant information or copies where legally required.
Requests concerning international data transfers or the exercise of data protection rights may be submitted to:
International transfers do not remove the rights and protections available to individuals under the GDPR.
Macua Tours Oy may use cookies, pixels, tags, scripts, and similar technologies on macuatours.com to support website functionality, maintain security, improve user experience, analyse website performance, and measure advertising effectiveness.
8.1. Essential Cookies
Certain cookies and technologies are necessary for the website to function properly, maintain security, and provide services specifically requested by visitors.
Strictly necessary cookies do not require prior consent where an exemption applies under Finnish law.
8.2. Analytics and Advertising Cookies
We may use analytics and advertising technologies to understand website traffic, measure visitor interactions, evaluate marketing campaigns, and improve our services.
Where these technologies require consent under applicable law, they must not be activated before the visitor has provided valid consent.
8.3. Cookie Consent and Preferences
Visitors must be given clear information about non-essential cookies and a genuine opportunity to accept or reject them before they are activated.
Consent must be freely given, specific, informed, and unambiguous. Non-essential cookies must not be enabled by default where consent is required.
Visitors must also be able to withdraw or modify their consent as easily as they originally provided it.
8.4. Third-Party Technologies
Some website features, analytics services, advertising platforms, or embedded content may involve technologies provided by third parties.
Where applicable, we provide information about the purposes of these technologies, their providers, and their storage or validity periods as required by law.
The use of third-party technologies remains subject to applicable privacy and electronic communications legislation.
8.5. Managing Cookies
Visitors may also manage or delete cookies through their browser settings. However, browser settings alone do not replace any consent mechanism required by law.
Disabling certain cookies may affect website functionality or prevent some optional features from operating as intended.
For questions about cookies, tracking technologies, or the processing of personal information, please contact:
Macua Tours Oy may send newsletters, travel updates, promotional offers, and information about our services when the recipient has provided valid consent or when electronic direct marketing is otherwise permitted by applicable law.
Where legally permitted, we may contact existing customers about our own similar travel services, provided the applicable legal conditions are met and the customer has been given a clear opportunity to opt out.
Submitting an inquiry, requesting a quotation, or booking a service does not automatically constitute consent to receive marketing communications.
Your Right to Opt Out
You may unsubscribe from marketing communications at any time by using the unsubscribe option provided in our marketing emails, where available, or by contacting:
Requests to stop direct marketing will be respected without charge. Once you have opted out, we will no longer process your personal information for the direct marketing concerned.
Operational and Transactional Communications
Opting out of marketing does not prevent Macua Tours Oy from sending necessary communications relating to your inquiries, quotations, confirmed bookings, payments, refunds, itinerary updates, travel arrangements, customer support, or legal obligations.
These communications are separate from promotional marketing and are sent when supported by an appropriate legal basis.
We process personal information used for marketing in accordance with the GDPR and applicable Finnish electronic communications legislation.
Macua Tours Oy retains personal information only for as long as necessary to fulfil the purposes for which it was collected, comply with applicable legal obligations, protect legitimate business interests, and establish, exercise, or defend legal claims.
Retention periods depend on the nature of the information, the purpose of processing, and applicable legal requirements.
10.1. Inquiries and Customer Communications
Information received through contact forms, email, WhatsApp, or other communication channels may be retained while reasonably necessary to respond to inquiries, prepare quotations, manage customer relationships, and maintain relevant business records.
10.2. Booking and Travel Records
Booking confirmations, itineraries, passenger information, supplier arrangements, and related communications may be retained for the duration of the travel arrangements and any additional period reasonably necessary for customer service, contractual obligations, complaints, disputes, or legal requirements.
10.3. Financial and Transaction Records
Invoices, payment confirmations, refund records, and other financial documents are retained for the periods required by applicable Finnish accounting, taxation, and financial legislation, including any additional retention required for legitimate legal or regulatory purposes.
10.4. Identity, Health, and Sensitive Information
Passport details, identification documents, health information, dietary requirements, accessibility information, and other sensitive travel-related data are retained only for as long as necessary for the relevant arrangements or another lawful purpose.
Information that is no longer required will be deleted, anonymised, or otherwise handled in accordance with applicable data protection requirements.
10.5. Marketing and Website Data
Marketing contact information and preferences are retained while there is a valid legal basis for their use. When a person withdraws consent or objects to direct marketing, we may retain limited information necessary to respect that choice and prevent further unwanted communications.
Website analytics, technical logs, and security-related information are retained according to their legitimate operational purposes, applicable consent requirements, and legal obligations.
10.6. Deletion and Retention Requests
Personal information will be deleted or anonymised when it is no longer necessary and no applicable legal basis requires its continued retention.
Certain records may need to be retained despite a deletion request where required by law or necessary for the establishment, exercise, or defence of legal claims.
Requests concerning personal information or its retention may be submitted to:
Macua Tours Oy takes the protection of personal information seriously and applies appropriate technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, misuse, alteration, destruction, or unlawful disclosure.
Security measures are determined according to the nature of the information processed, the purposes of processing, and the risks involved, in accordance with Article 32 of the EU General Data Protection Regulation (GDPR).
11.1. Website and Payment Security
Our website uses HTTPS to support encrypted communication between visitors and the website.
Payment transactions are handled through independent payment processors, banks, or financial platforms. Macua Tours Oy does not store complete payment card numbers directly on its website servers.
Payment providers maintain their own security controls and process relevant financial information under their applicable contractual and privacy terms.
11.2. Access to Personal Information
Access to customer information is limited according to legitimate business and operational requirements.
Appropriate safeguards may include account access controls, authentication measures, restricted permissions, secure communication practices, and measures designed to prevent unauthorised disclosure.
11.3. Independent Providers and International Operations
Macua Tours Oy shares necessary traveller information with independent local providers only for legitimate purposes connected with the requested travel services.
Providers are expected to handle customer information responsibly and in accordance with applicable legal and contractual requirements.
International transfers remain subject to the safeguards and legal conditions described in Section 7 of this Privacy Policy.
11.4. Sensitive and Travel-Related Information
Passport details, identification documents, medical information, and other sensitive travel-related data require particular care.
We seek to limit the collection, accessibility, use, and disclosure of such information to what is necessary and legally permitted for the relevant travel arrangements.
Travellers are encouraged to avoid transmitting highly sensitive information through unsecured channels unless specifically requested for a legitimate booking-related purpose.
11.5. Security Incidents
If a personal data security incident occurs, Macua Tours Oy will assess its nature, scope, and potential consequences.
Where required by the GDPR, we will notify the competent supervisory authority and affected individuals within the applicable legal requirements and time limits.
11.6. Security Limitations and Contact
Although appropriate safeguards are applied, no website, electronic communication system, or digital platform can guarantee absolute security.
Macua Tours Oy reviews its information security practices as appropriate to its operations and legal obligations.
For questions or concerns regarding the security of your personal information, please contact:
Macua Tours Oy respects your rights concerning the collection, use, storage, and protection of your personal information.
As a company established in Finland, Macua Tours Oy processes personal data in accordance with the EU General Data Protection Regulation (GDPR), regardless of your nationality or country of residence.
Subject to the conditions and limitations established by applicable law, you have the following rights:
12.1. Right of Access
You may request confirmation of whether we process your personal information and obtain access to that information, together with relevant details about how and why it is processed.
12.2. Right to Rectification
You may request the correction of inaccurate personal information or the completion of incomplete information.
12.3. Right to Erasure
You may request the deletion of your personal information when the conditions established by the GDPR are satisfied.
Certain information may need to be retained to comply with legal, accounting, taxation, contractual, or regulatory obligations, or to establish, exercise, or defend legal claims.
12.4. Right to Restrict or Object to Processing
You may request restrictions on certain processing activities or object to processing based on legitimate interests, subject to applicable legal conditions.
You have the right to object at any time to the processing of your personal information for direct marketing purposes.
12.5. Right to Data Portability
Where the applicable legal conditions are met, you may request to receive personal information you provided to us in a structured, commonly used, machine-readable format or request its transmission to another data controller where technically feasible.
12.6. Right to Withdraw Consent
Where processing is based on consent, you may withdraw that consent at any time.
Withdrawal does not affect processing lawfully carried out before consent was withdrawn or processing supported by another valid legal basis.
12.7. Automated Decision-Making
Where applicable, you have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects, except under the conditions permitted by the GDPR.
12.8. Exercising Your Rights
To exercise your privacy rights, please contact:
Macua Tours Oy will respond without undue delay and generally within one month of receiving your request, as required by the GDPR.
Where permitted by law, this period may be extended by up to two additional months due to the complexity or number of requests. If an extension is necessary, we will inform you within the initial one-month period.
Requests are generally handled free of charge, subject to exceptions permitted by law.
Where we have reasonable doubts about the identity of the person submitting a request, we may ask for additional information reasonably necessary to verify their identity and protect personal information from unauthorised disclosure.
12.9. Right to Lodge a Complaint
If you believe your personal information has been processed unlawfully, you may lodge a complaint with Finland’s Office of the Data Protection Ombudsman or another competent data protection supervisory authority.
Nothing in this Privacy Policy limits any mandatory data protection rights or remedies available under applicable law.
Macua Tours Oy is a company established in Finland and provides travel coordination services to international customers, including travellers residing in the United States.
Personal information processed by Macua Tours Oy is subject to the GDPR as described in this Privacy Policy.
Depending on the applicable legal requirements and the nature of our operations, residents of California and certain other U.S. states may also have additional rights under their respective privacy laws.
13.1. California Privacy Rights
Where the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), applies to our processing activities, eligible California residents may have rights to:
Request information about personal data collected, used, disclosed, sold, or shared.
Request access to, correction of, or deletion of personal information, subject to applicable exceptions.
Opt out of the sale or sharing of personal information for cross-context behavioural advertising.
Limit certain uses or disclosures of sensitive personal information where the relevant statutory provisions apply.
Exercise applicable privacy rights without unlawful discrimination or retaliation.
13.2. Sale and Sharing of Personal Information
Macua Tours Oy does not sell personal information for monetary consideration.
Certain analytics and advertising technologies may involve disclosures that qualify as the sharing of personal information under applicable U.S. state privacy legislation.
Where such legislation applies, we will respect legally applicable opt-out requirements, including recognised privacy preference signals where required by law.
13.3. Residents of Other U.S. States
Residents of other U.S. states may have additional privacy rights under applicable state legislation, including rights concerning access, correction, deletion, data portability, or targeted advertising.
Such rights will be assessed and respected where the relevant legislation applies.
13.4. Privacy Requests
California residents and other U.S. residents may contact Macua Tours Oy regarding their personal information at:
Requests will be assessed in accordance with the GDPR and any additional mandatory privacy laws applicable to the relevant processing activities.
Nothing in this section restricts the protections provided elsewhere in this Privacy Policy.
Macua Tours Oy coordinates travel services in Costa Rica and neighbouring destinations through independent local transportation providers, guides, accommodation providers, activity operators, and other travel service partners.
Personal information processed by Macua Tours Oy remains subject to the EU General Data Protection Regulation (GDPR), regardless of the traveller’s nationality or country of residence.
14.1. Personal Information Shared with Costa Rican Providers
To coordinate travel arrangements, we may share personal information with providers operating in Costa Rica when necessary to deliver the requested services.
This information may include passenger names, contact details, travel dates, transportation arrangements, accommodation information, identification details where required, and other information reasonably necessary for the contracted service.
Macua Tours Oy limits such disclosures to legitimate purposes and applies the international transfer requirements described in Section 7 of this Privacy Policy.
14.2. Costa Rican Data Protection Legislation
Costa Rica’s Law No. 8968, Ley de Protección de la Persona frente al Tratamiento de sus Datos Personales, establishes protections concerning the processing of personal information.
Where Costa Rican data protection legislation applies to a particular processing activity, the relevant rights and obligations must be respected.
These may include rights concerning access to personal information, correction of inaccurate data, deletion where legally justified, and control over the disclosure of personal information.
Independent Costa Rican providers may also have their own responsibilities under applicable local data protection legislation.
14.3. Privacy Requests and Complaints
Travellers may contact Macua Tours Oy regarding access, correction, deletion, or other questions concerning their personal information at:
Where Costa Rican law applies, individuals may also have the right to seek protection through Costa Rica’s data protection authority, the Agencia de Protección de Datos de los Habitantes (PRODHAB).
14.4. Continued GDPR Protection
The involvement of Costa Rican service providers does not remove Macua Tours Oy’s responsibilities under the GDPR.
Travellers continue to benefit from the applicable rights, protections, and remedies described throughout this Privacy Policy.
Macua Tours Oy is established in Finland and is the data controller for the personal information described in this policy. The EU General Data Protection Regulation (GDPR) applies to our processing of that information regardless of your nationality or country of residence.
We may share necessary personal information with providers in Costa Rica, Nicaragua, and other destinations to respond to your inquiry or coordinate your trip. Transfers outside the European Economic Area are subject to the GDPR’s international data transfer requirements.
Subject to the conditions set out in the GDPR, you have rights to access, correct or delete your personal information, restrict or object to its processing, request data portability, and withdraw consent where processing relies on consent. You may lodge a complaint with Finland’s Office of the Data Protection Ombudsman or another competent data protection authority.
Macua Tours Oy provides travel coordination services primarily to adults, families, and organised groups. Our website is not specifically directed to children under the age of 13.
We do not knowingly solicit personal information directly from children under 13 without appropriate parental or guardian involvement.
16.1. Information About Minors Travelling with Adults
When arranging family travel or group bookings, a parent, legal guardian, or appropriately authorised adult may provide personal information about minors where necessary for the requested services.
This may include names, ages, travel document details, accommodation requirements, transportation arrangements, dietary restrictions, accessibility needs, and other relevant travel information.
We collect and process such information only where supported by an appropriate legal basis and for purposes reasonably necessary to coordinate the travel arrangements.
16.2. Additional Protection for Children’s Data
Macua Tours Oy recognises that children’s personal information requires particular protection.
We limit the collection, use, retention, and disclosure of information concerning minors and share it with independent local providers only where necessary and legally permitted.
Where processing requires consent from a parent or legal guardian under applicable law, we will seek the appropriate authorisation.
16.3. Requests Concerning Children’s Information
Parents, legal guardians, and individuals entitled to exercise their own data protection rights may contact Macua Tours Oy to request access, correction, deletion, or other legally available measures concerning personal information.
Requests may be submitted to:
We will assess such requests in accordance with the GDPR, applicable Finnish legislation, and the rights and interests of the child.
The Macua Tours website may contain links to independent third-party websites and services, including payment platforms, accommodation providers, activity operators, travel information resources, review platforms, and social media services.
These websites and platforms may collect or process personal information under their own privacy policies and applicable legal obligations.
Macua Tours Oy does not control the content, security practices, or independent data processing activities of third-party websites that are not operated on its behalf.
We encourage visitors to review the privacy policies and terms of any external website before providing personal information.
Where Macua Tours Oy shares personal information directly with third-party providers or engages service providers to process information on its behalf, such processing remains subject to our applicable responsibilities under the GDPR and the requirements described in this Privacy Policy.
Nothing in this section excludes any responsibility that Macua Tours Oy is legally required to assume.
Macua Tours Oy may receive reviews, testimonials, photographs, videos, and other feedback voluntarily submitted by travellers.
We may request permission to feature selected content on our website, social media channels, promotional materials, or other communications relating to our travel services.
18.1. Permission to Use Customer Content
Submitting a review, photograph, video, or testimonial does not automatically authorise Macua Tours Oy to use that content for advertising or promotional purposes.
Where consent or another legal basis is required for processing personal information, we will obtain the appropriate authorisation before using identifiable customer content for marketing.
Any use of copyrighted material will also be subject to the necessary permissions or other applicable legal grounds.
18.2. Privacy and Sensitive Information
Macua Tours Oy does not use passport images, private identification documents, financial information, confidential booking records, medical information, or other sensitive customer details for promotional purposes.
Special care is taken when photographs or videos feature children or other individuals whose personal information requires additional protection.
18.3. Withdrawal and Removal Requests
Where the processing of personal information is based on consent, individuals may withdraw that consent at any time.
If you previously authorised us to use a testimonial, photograph, video, or other identifiable content and would like to request its removal, please contact:
We will assess and process the request in accordance with applicable data protection law, any relevant intellectual property rights, and the circumstances of the publication.
Macua Tours Oy may process and retain personal information where necessary to comply with legal obligations, respond to lawful requests, protect its legitimate business interests, or establish, exercise, or defend legal claims.
Such processing may be necessary in connection with customer complaints, payment disputes, refund requests, chargebacks, suspected fraud, contractual disagreements, regulatory inquiries, or judicial proceedings.
19.1. Information Used in Dispute Resolution
Depending on the circumstances, relevant records may include booking confirmations, quotations, invoices, payment confirmations, refund records, customer communications, travel itineraries, supplier coordination records, and evidence of services provided.
Macua Tours Oy limits the information used or disclosed to what is relevant and necessary for the specific matter.
19.2. Disclosure to Relevant Parties
Where appropriate and legally permitted, relevant information may be shared with payment processors, banks, card networks, insurers, legal advisors, competent authorities, courts, or other parties involved in resolving a legitimate claim or dispute.
Such disclosures will be made in accordance with applicable legal requirements, including the GDPR.
19.3. Retention and Data Protection Rights
Records relating to legal claims, regulatory obligations, fraud prevention, or financial disputes may be retained for the period reasonably necessary and legally permitted.
The exercise of privacy rights remains subject to the conditions and exceptions established by applicable law.
Questions concerning the processing of personal information in connection with a complaint or dispute may be submitted to:
Macua Tours Oy may update this Privacy Policy from time to time to reflect changes in our services, operational practices, technology, legal obligations, or applicable data protection requirements.
When material changes are made, we will update the “Last Updated” date displayed at the beginning of this Privacy Policy.
Where required by applicable law, we will provide additional notice through our website, email, or another appropriate communication channel.
If a change involves processing personal information for a new purpose, Macua Tours Oy will provide the information required by the GDPR before carrying out that processing.
Where consent is legally required, we will obtain valid consent before undertaking the relevant processing activities.
Continued use of our website does not, by itself, constitute consent to personal data processing for which separate consent is legally required.
The latest published version of this Privacy Policy will be available at:
https://macuatours.com/privacy-policy/
Any changes will apply in accordance with their stated effective date and applicable data protection law.
For questions, requests, or concerns about this Privacy Policy or your personal information, contact:
Macua Tours Oy
Business ID: 3646124-7
Country of registration: Finland
Privacy and Customer Support:
[email protected]
Phone: +1 (646) 372-9265
Business address for formal notices:
Sahatie 4 C 38, 01650 Vantaa, Finland
This address is used for formal business notices and is not a walk-in customer office.
Macua Tours and Macuá Tours are public-facing names used by Macua Tours Oy and do not represent separate legal entities.
If you wish to exercise your data protection rights, please contact us through the email address provided above.
You also have the right to lodge a complaint with Finland’s Office of the Data Protection Ombudsman or another competent supervisory authority.
