Privacy Policy

1. Age Requirement (Minors Policy)

In order to register as a User and browse Vermilion, you must be over 14 years of age. Vermilion may use personal information to verify age and ensure compliance with this restriction.

Parents or legal guardians of minors may contact Vermilion at any time to request the blocking or deletion of personal data via info@vermilionroutes.com.

2. What Personal Data Do We Process?

• User Registration: Name and email address (or Facebook profile info if registering via social login).
• Contracting & Expeditions: Full personal details including nationality, residential address, contact phone number, identity document or passport number.
• Tour Bookings: Traveler names, nationalities, passport numbers, and emergency contact details.
• Payments & Transactions: Credit/debit card details, expiration dates, CVV, or bank transfer confirmation receipts. Payments are processed through certified PCI-DSS compliant secure gateways with end-to-end encryption.
• Invoicing: Tax identification and official billing addresses where requested.
• Customer Support: Inquiries, preferences, and communication history.
• Cookies & Analytics: Browsing preferences, page interactions, and statistical analytics as configured in your browser.

3. Purposes of Data Processing

Vermilion, as Data Controller, processes personal data for:

• Managing user registration, private area access, and saved preferences.
• Executing mediation and organization of travel packages, cruises, hotels, and transport services.
• Providing active customer support, itinerary updates, and urgent travel alerts.
• Sending customized commercial communications and promotions (with prior user consent).
• Auditing security and fraud prevention.

4. Legal Basis (Legitimation)

Data collection and processing is legally based on:

• Execution of the contractual travel mediation agreement.
• Adoption of pre-contractual measures requested by the client.
• Compliance with legal, fiscal, and regulatory tourism obligations.
• Explicit user consent for marketing communications and cookies.

5. Data Retention & Recipients

Data will be maintained for the duration of the commercial relationship and statutory prescription periods established by applicable Ecuadorian and international law.

Data may be communicated strictly when necessary to:

• Tourism providers (Galapagos cruise operators, airlines, hotels, local guides) for booking confirmation.
• Technology & payment infrastructure providers (Firebase, certified payment processors).
• Competent public and judicial authorities upon statutory legal request.

6. Exercise of Rights

At any time, you may exercise your rights of access, rectification, deletion, opposition, limitation of processing, or portability by contacting our Data Protection team at: