Privacy Policy and Data Protection for Travelers

1. Age Requirement (Minors Policy)

In order to register as a User and browse Vermilion, you must be over 14 years of age. Vermilion may use personal information to verify age and ensure compliance with this restriction.

Parents or legal guardians of minors may contact Vermilion at any time to request the blocking or deletion of personal data via info@vermilionroutes.com.

2. What Personal Data Do We Process?

• User Registration: Name and email address (or Facebook profile info if registering via social login).
• Contracting & Expeditions: Full personal details including nationality, residential address, contact phone number, identity document or passport number.
• Tour Bookings: Traveler names, nationalities, passport numbers, and emergency contact details.
• Payments & Transactions: Payment status, amount, currency, receipts, processor order IDs, capture IDs, transaction references, and anti-fraud signals. Vermilion does not store full card numbers, CVV codes, or card expiration data; card processing is handled by PCI-DSS compliant payment providers such as Stripe and PayPal.
• Invoicing: Tax identification and official billing addresses where requested.
• Customer Support: Inquiries, preferences, and communication history.
• Cookies, Analytics & Advertising: Consent choices, affiliate attribution references, browsing preferences, page interactions, and campaign data when you authorize optional cookies or similar technologies.

3. Purposes of Data Processing

Vermilion, as Data Controller, processes personal data for:

• Managing user registration, private area access, and saved preferences.
• Executing mediation and organization of travel packages, cruises, hotels, and transport services.
• Providing active customer support, itinerary updates, and urgent travel alerts.
• Sending customized commercial communications and promotions (with prior user consent).
• Auditing security and fraud prevention.
• Understanding website performance and improving advertising campaigns only where required cookie consent has been granted.

4. Legal Basis (Legitimation)

Data collection and processing is legally based on:

• Execution of the contractual travel mediation agreement.
• Adoption of pre-contractual measures requested by the client.
• Compliance with legal, fiscal, and regulatory tourism obligations.
• Explicit user consent for marketing communications, analytics, advertising cookies, and optional cookies or similar technologies.
• Legitimate interest for essential security, fraud prevention, service integrity, and affiliate attribution necessary to honor a valid referral.

5. Data Retention, Recipients & International Transfers

Data is retained only for as long as needed for the travel relationship, legal obligations, fraud prevention, and statutory prescription periods established by applicable Ecuadorian and international law. As a practical rule, booking, invoicing, tax, and payment reference records may be retained for the legally required accounting period; inactive leads are periodically reviewed; marketing records are kept until consent is withdrawn or the record is no longer necessary.

Data may be communicated strictly when necessary to:

• Tourism providers (Galapagos cruise operators, airlines, hotels, local guides) for booking confirmation.
• Technology, hosting, authentication, analytics, email, and payment infrastructure providers, including Firebase/Google services, Stripe, PayPal, and authorized email or CRM providers.
• Competent public and judicial authorities upon statutory legal request.

Because we serve international travelers, some providers may process data outside your country of residence, including Ecuador, the United States, the United Kingdom, the European Economic Area, or other jurisdictions where our providers operate. Where required, we rely on contractual safeguards, provider security commitments, and user consent for optional cookies or similar technologies.

6. Cookies, Consent & Advertising Tools

Necessary cookies and local storage are used to keep the website secure, remember basic preferences, manage language selection, preserve affiliate attribution, and support booking flows. Optional analytics and advertising cookies are activated only after consent where applicable.

• Necessary technologies: language preference, security, booking state, affiliate referral references, and site functionality.
• Optional cookies: Google Analytics, Google Ads, Meta Pixel, or Microsoft Clarity may be used only when configured and consented to, to understand campaign performance and improve the website.
• Payment and fraud prevention: Stripe, PayPal, Firebase, and related security services may process technical signals necessary to complete payments and prevent abuse.

You can decline optional cookies from the consent banner. After making a choice, a small “Cookies” button remains available on the site so you can reopen your privacy choices. You can also clear your browser storage or contact us to request help with privacy choices.

7. Exercise of Rights

At any time, you may exercise your rights of access, rectification, deletion, opposition, limitation of processing, or portability by contacting our Data Protection team at:

Depending on your location, you may also have rights under Ecuador's Organic Law on Personal Data Protection, the EU/UK GDPR, United States state privacy laws, or similar privacy rules. We will evaluate verified requests according to the law that applies to your relationship with Vermilion.