Privacy policy

1. Who we are

The reotrip.com website is owned and operated by REOTRIP TECHNOLOGY LIMITED (臻誠旅游科技有限公司), a Hong Kong company with Business Registration No. 76983345. The company is the data controller for the personal data described in this policy. This means it decides how the data is used and is responsible for it. In this policy, "ReoTrip", "we" and "us" mean this company.

Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486) applies to how we handle personal data.

Address: Room 5003, Floor 5, Yau Lee Centre, 45 Hoi Yuen Road, Kwun Tong, Kowloon, Hong Kong. Email: order@reotrip.com. Telephone: +852 5961 7562.

2. Personal data we collect

We collect the following personal data:

• Contact details: your name and email address, which are required to place an order, and your phone number if you choose to give it.
• Booking details: the product, option, travel date, time, quantity, order total and currency, order number, and any notes you add at checkout.
• Traveler details: answers to questions that the supplier partner requires for a specific product, such as traveler names, ages, nationality, or flight details.
• Payment records: the payment session reference, payment status, and refund references from our payment service provider. We do not receive or store your full card number or CVC. If a refund has to be paid by bank transfer, we also collect the bank account details you give us for it.
• Messages: emails you send us and our replies about your order.
• Technical data: your IP address and information about your device and browser. Our hosting and security systems process this data when your browser connects to the site, for example to deliver pages and to limit repeated requests from the same IP address.

3. Where the data comes from

Most of the data comes from you, when you fill in the checkout form or contact us.

Technical data comes from your browser or device when you use the site.

Our payment service provider tells us whether a payment or refund has succeeded and gives us its references. If you dispute a charge, we may also receive from the payment service provider and your bank the information needed to handle the dispute.

Supplier partners give us the confirmation details for your booking, such as a confirmation number, voucher or visit instructions.

If you give us details of other travelers, please make sure they know that you are sharing their data with us for the booking.

4. How we use your data

We use your personal data to:

• create your order and take payment through our payment service provider's hosted payment page;
• send you a payment receipt by email;
• book your service with the supplier partner and confirm the booking;
• send the confirmation, including the supplier's confirmation number when one is issued and the voucher or visit instructions, to the email address you gave at checkout;
• contact you about your order, for example if the operator has not opened bookings for your date yet or a refund is due;
• handle cancellations, refunds, billing questions, complaints and payment disputes;
• prevent fraud and abuse and keep the site secure;
• keep accounting and tax records and meet our other legal obligations.

5. Grounds for using your data

We use your personal data only for the purposes in section 4 and purposes directly related to them. Depending on the purpose, we rely on one of these grounds:

• Contract: to take, confirm, deliver, change or refund the booking you ask for. Without your name and email address we cannot accept your order.
• Legal obligations: to keep accounting and tax records and to respond to lawful requests from authorities.
• Legitimate interests: to prevent fraud and abuse, keep the site and payments secure, and handle claims and disputes.

6. Who we share your data with

We do not sell your personal data. We share it only with the recipients below, and only the data each of them needs:

• Payment service providers. Payments on reotrip.com are processed by third-party payment service providers, currently mainly Stripe. We may also use other payment service providers. We share with the provider that handles your payment the transaction data it needs, such as your email address, order number, product name, amount, quantity and currency. The provider collects your card details directly on its own payment page. To process payments, refunds and disputes, the payment service provider may share transaction data with payment method providers, such as card networks, and with settlement banks. If you dispute a charge, we give the payment service provider handling the dispute the order details, our messages with you, and the cancellation rules that applied to your order.
• Our bank. If we refund you by bank transfer, our bank receives your name, bank account details and the refund amount to make the transfer.
• Supplier partners. The supplier partner that delivers your service receives only the details needed to confirm and deliver it, such as traveler names, travel date, time, quantity, option, and answers to the supplier's questions.
• Service providers. Companies that host the website and database and that send our emails process data to provide these services to us. Some images on the site may be served by third-party image hosts, which receive your IP address and browser information when your browser loads the images.
• Professional advisers, such as lawyers, accountants and auditors, where needed.
• Authorities, courts and regulators, where the law requires it or where needed to protect our legal rights.

7. International data transfers

ReoTrip is operated by a Hong Kong company. The services used for payment, hosting, email, and support may be located outside your country or region, so your personal data may be processed or stored outside it.

Our supplier partners may also be located outside your country or region. Payment service providers may process transaction data in the countries or regions where they and their payment partners operate.

Data protection laws in those places may differ from the laws where you live. We share with each recipient only the data it needs for the purposes in this policy.

8. How long we keep your data

We keep personal data only as long as we need it for the purposes in this policy. Our retention periods are:

• paid-order data and related financial records: usually up to 7 years, or another period needed for accounting, tax requirements, claims and chargebacks;
• orders that were started but not paid: kept in our order records; we do not currently delete them automatically;
• support correspondence: up to 3 years after your last message;
• technical logs: usually up to 12 months, unless a longer period is needed for security or legal reasons.

9. How we protect your data

You pay on our payment service provider's hosted payment page. Your card details go directly to the provider. We do not receive or store your full card number or CVC.

Data sent between your browser and reotrip.com is encrypted using HTTPS.

Our staff get access to order data according to their role.

No method of transmission or storage is completely secure. If you think your personal data has been misused, contact us at order@reotrip.com.

10. Your rights

You can:

• ask for a copy of the personal data we hold about you;
• ask us to correct data that is inaccurate;
• ask us to delete your data, or to stop or limit using it, where we do not need to keep it for your order, for legal reasons, or for fraud prevention;
• withdraw your consent at any time, if we ask for your consent to use your data for a purpose not described in this policy;
• complain to us or to a data protection authority about how we handle your data (see section 11).

11. How to make a request or complaint

Send requests to access or correct your personal data, and any other request about your data, by email to order@reotrip.com. You can make a complaint by email or by calling +852 5961 7562. Include the email address used for your order, the order number if you have one, and what you would like us to do.

Before we act on a request, we may ask you to confirm your identity and your link to the order, so that we do not disclose data to the wrong person.

We reply by email within 15 business days after we receive your request or complaint, including one made by phone. Business days are Monday to Friday, excluding Hong Kong public holidays.

If you are not satisfied with our reply, reply to that email and ask for a review. A member of our team who was not involved in the case reviews it and emails you the outcome within 15 business days.

You can also complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD), or to the data protection authority where you live.

12. Cookies

ReoTrip uses only cookies that are needed for reotrip.com to work. We do not use analytics or advertising cookies.

When you go to payment, you leave reotrip.com for the payment service provider's own payment page. The provider may set its own cookies there under its own policy.

For details, see our Cookie policy.

13. Children

The site is not intended for children to place orders on their own. If an order includes a child traveler, the child's details should be given by a parent, legal guardian, or an adult traveling with the child who has the right to give them.

14. Changes to this policy

We may update this policy. We post every update on this page.

This version takes effect on the date shown at the top of this page.

15. Contact us

For any question about this policy or your personal data, contact REOTRIP TECHNOLOGY LIMITED at order@reotrip.com or +852 5961 7562.

Address: Room 5003, Floor 5, Yau Lee Centre, 45 Hoi Yuen Road, Kwun Tong, Kowloon, Hong Kong.