Privacy Policy

This policy sets out how TourLuk collects, uses, stores, shares, and protects the personal data of customers, website users, consultants, voucher recipients, companions, and related individuals during the process of searching, booking tours, paying, receiving vouchers, using services, or ontacting TourLuk.

1. Information Collection and Management Unit

Information collection and management unit:	NGÔISAOGROUP TOURISM AND INVESTMENT JOINT STOCK COMPANY
Address:	173/1 DaoCamMoc, Chánh Hưng Ward, Hồ Chí Minh City.
Hotline:	+84 8 1919 0101.
Email:	contact@tourluk.com
Website:	tourluk.com

2. Data Protection Principles

TourLuk only collects information relevant to the purposes of providing travel services, confirming bookings, processing payments, reconciling, caring for customers, protecting the legitimate rights of parties, and complying with the law.

TourLuk does not require customers to provide unnecessary information for booking services, except where such information is a mandatory condition to execute the tour, book tickets, book rooms, purchase insurance, complete immigration procedures, transport, or serve specific customer requests.

Personal information is used for the stated purposes, limited in access based on job roles, and subject to appropriate security measures based on actual operational conditions.

Customers have the right to request access, correction, restriction of processing, deletion, or withdrawal of consent to personal data within the scope permitted by law.

TourLuk does not sell, rent, or exchange customer personal information to third parties for independent commercial purposes without customer consent, except as otherwise provided by law.

3. Purposes of Information Collection

Creating, managing, confirming, and executing bookings for tours, attraction tickets, transportation services, hotels, experience services, combos, or related travel services.

Contacting to confirm bookings, departure dates, number of guests, passenger information, pick-up/drop-off points, special requests, and any changes arising before, during, or after the trip.

Sending emails, messages, account notifications, e-vouchers, booking codes, invoices, documents, itineraries, service usage instructions, and necessary support information.

Processing payments, verifying transactions, bank reconciliation, processing refunds, processing service cancellations, managing vouchers, and related accounting operations.

Transferring necessary information to TourLuk’s domestic and international service provider partners to reserve, confirm services, arrange transportation, accommodation, attraction tickets, insurance, guides, or support incidents at the destination.

Supporting customers, receiving feedback, resolving complaints, disputes, refund requests, information adjustment requests, or requests related to personal data.

Preventing fraud, abnormal transactions, voucher abuse, unauthorized account usage, account takeover, or illegal acts.

Sending promotional information, offers, travel guides, or customer care materials if the customer agrees or does not opt-out of receiving information as prescribed.

Analyzing data at an appropriate level to improve service quality, website experience, tour content, pricing policy, customer care policy, and operational efficiency.

Complying with requests from competent state authorities or legal obligations as prescribed by law.

4. Scope of Information That May Be Collected

Information Group	Information that may be collected
Basic identification information	Full name, gender, date of birth, phone number, email, contact address, country/region of residence, preferred language.
Account information	Login email, encrypted password, login history, account status, information change history, vouchers, wishlist, orders, reviews.
Service booking info	Booking code, tour/service name, departure date, pick-up/drop-off point, number of guests, tour type, room type, single room surcharge, discount code, special requests, operational notes, booking status.
Passenger info	Full name as per passport, passport number, issue/expiry date, nationality, date of birth, visa information if necessary, emergency contact info, travel insurance if any.
Health info/Special requests	Food allergies, vegetarian requests, mobility restrictions, requests for elderly/child support or information needed to arrange suitable services, only collected when voluntarily provided by the customer or required by the service.
Payment info	Payment method, amount, currency, transaction code, time of payment, payment status, bank transfer info, refund info, voucher usage history. TourLuk does not store full card numbers if transactions are via third-party payment gateways.
Technical info	IP address, device type, browser, operating system, cookies, login session token, viewed pages, access time, interaction behavior with the website, and system logs.
Communication info	Email, messages, calls, consultation content via hotline, Zalo, Messenger, website forms, or other official support channels.

5. Organizations and Individuals Who May Access Information

Relevant internal departments of TourLuk such as sales, operations, customer service, accounting, technical, system administration, and quality management.

TourLuk’s domestic and international service provider partners only access necessary information to hold seats, issue vouchers, verify guests using the service, operate tours, book tickets, book rooms, transport, insure, or handle incidents.

Banks, payment gateways, transaction reconciliation units, anti-fraud units, technical infrastructure providers, email, SMS, CRM, website analytics, or system security units within the necessary scope.

Competent state authorities upon legal request in accordance with the law.

Other third parties with the customer’s consent or when necessary to protect the legitimate rights of customers, TourLuk, or related parties.

6. Cross-Border Data Transfer

Due to the nature of international travel services, customer information may need to be transferred to TourLuk’s service provider partners, hotels, carriers, insurance providers, attractions, tour operators, or technical systems in the country where the service is provided.

Data transfer is only carried out within the scope necessary to reserve, confirm services, issue vouchers, operate tours, handle incidents, refund, or comply with legal requirements at the destination.

TourLuk requires data recipients to use the information for the correct purposes, secure the information, and not arbitrarily use the information for purposes outside the scope of service provision.

7. Cookies, Login Tokens, and Technical Data

TourLuk may use cookies, local storage, pixels, or similar technologies to maintain login sessions, remember language/currency preferences, save shopping carts, analyze usage behavior, measure advertising effectiveness, and protect accounts.

Necessary technical cookies help the website operate stably. Analytical/marketing cookies are used according to website configurations and user choices when the website has an opt-in/out mechanism.

Customers can manage or delete cookies in their browser. However, some functions such as logging in, shopping cart, payment, or saving vouchers may not fully operate if cookies are disabled.

8. Information Storage Time

Personal information is stored for the time necessary to fulfill the collection purposes, provide services, process bookings, care for customers, resolve complaints, and perform accounting, tax, and related legal obligations.

Booking info, payments, invoices, documents, reconciliations, and refund/cancellation records may be stored according to legal limits on accounting, taxation, electronic transactions, tourism, and consumer protection.

Account information is kept until the account is deleted, deactivated, or when the customer requests deletion and the request qualifies under the law.

TourLuk may continue to store a portion of data in a restricted form if necessary to prevent fraud, protect legal rights, resolve disputes, or fulfill legal obligations.

9. Information Security Measures

Access control based on job roles; limiting personnel who can view, edit, or export customer data.

Encryption or application of appropriate protective measures for passwords, login tokens, payment data, and sensitive information.

Using secure SSL/TLS connections for the website and key data processing channels.

Keeping access logs, data change logs, payment logs, and booking processing logs for inspection, reconciliation, and fraud prevention purposes.

Applying procedures for permission granting, permission revocation, data backup, and system recovery suitable to actual operational conditions.

Requiring technical partners, payment partners, and service provider partners of TourLuk to secure information under confidentiality agreements or contracts.

In case of discovering an incident affecting personal data, TourLuk will inspect, remedy, limit damages, and notify data subjects/competent authorities as prescribed by law if it falls into mandatory notification cases.

10. Customer’s Rights Regarding Personal Data

Request to be informed about the processing of their personal data.

Request to view, update, correct, or supplement inaccurate personal information.

Request deletion, destruction, or restriction of processing of personal data within the limits of the law.

Withdraw consent for optional data processing purposes, e.g., receiving marketing information.

Refuse to receive advertising/promotional emails and messages if no longer needed.

Complain, report, or request an explanation regarding the processing of personal data.

11. Process for Requesting Access, Correction, Deletion, or Restriction of Data Processing

Customers send requests via email contact@tourluk.com, hotline +84 8 1919 0101, or support channels announced on the website.

The request must clearly state the full name, contact information, processing content, data scope, relevant booking/account code, and verification documents if requested.

TourLuk receives, verifies the requester’s identity, and responds within a reasonable time. For complex requests or those involving domestic/foreign service provider partners, TourLuk may need additional verification time and will notify the customer.

TourLuk reserves the right to refuse or partially fulfill the request if the data must be retained to fulfill legal obligations, resolve disputes, prevent fraud, protect legitimate interests, or if the requester cannot prove their right to request.

12. Customer Responsibilities

Provide accurate, complete, and updated information when booking services, especially the full name as per passport, nationality, date of birth, visa info, departure date, phone number, and voucher receiving email.

Self-secure accounts, passwords, OTPs, confirmation emails, booking codes, and e-vouchers.

Immediately notify TourLuk upon discovering unauthorized use of the account, email, phone, voucher, or booking code.

Do not provide personal data of companions without their consent or without legal representation rights.

13. Changes to the Privacy Policy

TourLuk may update the Privacy Policy to suit operational models, service changes, technology updates, or legal requirements.

The updated version is publicly posted on the tourluk.com website and takes effect from the time of posting or the time specified in the update notice.

Customers should regularly check the Privacy Policy to stay informed of the latest changes.