Privacy Policy

1. Who We Are

Boka Boat Tours is a boat tour operator based in Kotor, Montenegro. We operate private and group boat tours in the Bay of Kotor. This Privacy Policy explains how we collect, use, and protect your personal data when you use our website at www.bokaboattours.com or make a reservation with us.

2. What Data We Collect

When you make a reservation through our website, we collect the following information:

• Full name — to identify your reservation
• Email address — to send your reservation confirmation
• Phone / WhatsApp number — to confirm your booking and communicate about your tour
• Tour date and time — to schedule your departure
• Number of guests and ages — for group tours, to calculate pricing and plan capacity
• Special requests or notes — if you choose to provide them
• Payment method preference — cash, bank transfer, or card (no payment card data is stored on our servers)

We do not collect any sensitive personal data such as passport numbers, health information, or financial account details beyond what is strictly needed to process your tour payment.

3. How We Use Your Data

We use the data you provide exclusively for the following purposes:

• Processing and confirming your reservation
• Communicating with you about your tour (time, meeting point, weather conditions)
• Sending your booking confirmation and reminder via email or WhatsApp
• Scheduling our operations and captain assignments
• Complying with applicable legal obligations in Montenegro

We do not use your data for marketing purposes, newsletters, or automated profiling without your explicit consent.

4. Legal Basis for Processing

We process your personal data on the following legal bases under the General Data Protection Regulation (GDPR) and applicable Montenegrin data protection law:

• Contract performance — processing is necessary to fulfil your reservation and deliver the service you requested
• Legitimate interest — to manage our business operations, respond to enquiries, and ensure the safety of our guests
• Legal obligation — where required by Montenegrin maritime or tax regulations

5. Data Sharing

We do not sell or share your personal data with third parties for commercial purposes. We may share limited data only in the following circumstances:

• Google Calendar — reservation details (name, tour, date, time) are stored in a private Google Calendar accessible only to our team, to manage scheduling
• Email provider (SMTP) — your name and email address are used to send you a confirmation email via our mail server
• Legal authorities — if required by law, court order, or mandatory reporting obligations under Montenegrin law

All third-party services we use are bound by their own privacy policies and data protection obligations.

6. Data Retention

We retain your reservation data for a period of 2 years from the date of your tour, in accordance with standard business record-keeping requirements. After this period, your data is permanently deleted from our systems.

If you request deletion before this period, we will comply within 30 days, unless we are required by law to retain certain records.

7. Data Security

We take the security of your personal data seriously. Our measures include:

• HTTPS encryption for all data transmitted through our website
• Access-restricted reservation files, not publicly accessible
• Password-protected administration panel
• Rate limiting and request validation on all form submissions
• No storage of payment card numbers on our servers

While we take every reasonable precaution, no system is completely immune to risk. In the event of a data breach that affects your rights, we will notify you and relevant authorities as required by law.

8. Your Rights

Under the GDPR and applicable data protection laws, you have the following rights regarding your personal data:

• Right of access — you may request a copy of the personal data we hold about you
• Right to rectification — you may ask us to correct inaccurate or incomplete data
• Right to erasure — you may request deletion of your data ("right to be forgotten")
• Right to restriction — you may ask us to restrict processing of your data in certain circumstances
• Right to data portability — you may request your data in a structured, machine-readable format
• Right to object — you may object to processing based on legitimate interest

To exercise any of these rights, please contact us using the details below. We will respond within 30 days.

9. Cookies

Our website does not use tracking cookies, advertising cookies, or third-party analytics services. We do not use Google Analytics, Facebook Pixel, or any other behavioural tracking technology.

The only technical data processed is standard web server logs (IP address, browser type, page accessed, timestamp), which are retained for a maximum of 90 days for security and performance monitoring purposes only.

10. Children's Privacy

Our services are intended for adults. We do not knowingly collect personal data from children under the age of 16 without the consent of a parent or legal guardian. If you believe we have inadvertently collected such data, please contact us and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we do, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

12. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data rights, or have a concern about how we handle your data, please contact us: