Privacy Policy

Galápagos Ecuador Trips (“we”, “us”) plans trips to the Galápagos Islands and mainland Ecuador. We are the company responsible for your personal information when you use galapagosecuadortrips.com or contact us.

You can reach us at hello@galapagosecuadortrips.com or on WhatsApp at +593 98 365 4106.

We only ask for what we need to plan your trip.

What you give us

• Your name, email, phone or WhatsApp number and country.
• Your trip choices: programme, number of travellers, month or date, hotel level and area, options for each day, extras and bed type.
• Anything you write in the notes box, and anything you send us by email or WhatsApp.

What we collect automatically when you use the form

• The page you were on, the website that sent you to us and your time zone.
• The tags in the link you clicked, for example utm_source or gclid. They tell us which post or ad brought you.
• A technical submission ID, and how long the form was open. We use this to stop spam.

What we create for you

A reference number and your order sheet (PDF), with the details you chose.

Each use of your information needs a legal reason. These are ours:

We use your details only to answer your request. We do not put you on a marketing list without asking you first.

We do not sell your information. We share it only with people and companies that help us run the service.

• Google (Google Workspace): the private spreadsheet where we store requests, and the email we use to send your order sheet.
• Our team, who answer you and plan your trip.
• Hotels, guides, tour operators and transport companies, only if you book, and only what they need, such as names and dates.
• Banks and payment providers, only when you pay.
• Our website host, Google Fonts and Google Tag Manager: they may see your IP address and browser details when the page loads.
• WhatsApp (Meta), only if you choose to message us there.
• Authorities, when the law requires it.

Some of these providers, such as Google, may process information outside Ecuador, including in the United States. When that happens, we use providers that apply recognised data protection safeguards, and we share only what is needed.

• Requests that do not become a booking: up to 24 months after our last contact. Then we delete or anonymise them.
• Bookings: while your trip is arranged and delivered, and afterwards for as long as the law requires us to keep accounting and tax records.
• Security logs: a short time only.

You can ask us to delete your information earlier. See section 10.

Today our website uses only what it needs to work:

• Your language choice (English or Spanish), saved in your browser so we remember it.
• The campaign tags from the link you used, kept in your browser only until you close the tab.
• Basic technical cookies that WordPress or our host may set to keep the site secure and working.

We do not use these to follow you around other websites. You can delete or block cookies and stored data in your browser settings. The site still works, but you may need to choose your language again.

We use Google Tag Manager to manage website tools. At the date of this policy, we do not run Google Analytics, Google Ads or Meta (Facebook and Instagram) tracking.

If we turn them on, we will:

• ask for your consent first, with a cookie banner;
• update this policy and the date at the top;
• let you change your mind at any time.

These tools may use cookies and receive information such as the pages you visit, your device and your approximate location. To measure the results of our ads, they may also receive a scrambled (hashed) version of your email or phone after you send the form.

We look after your information in these ways:

• The site and the form use secure HTTPS connections.
• Requests go to a private spreadsheet that only our team can open.
• Our server checks every request and has limits against spam and misuse.
• Only people who need your information to help you can see it.

No system is 100% secure. If a security incident affects your information, we will tell you and the authorities as the law requires.

Under Ecuador’s Organic Law on Personal Data Protection and, if you live in the European Union, the GDPR, you can:

• Access the information we hold about you.
• Correct information that is wrong or incomplete.
• Delete your information.
• Object to how we use it, or ask us to pause it.
• Take it with you (portability): ask for a copy in a common format.
• Withdraw your consent at any time. This does not affect what we did before.
• Not be judged by automated decisions. We do not use automated profiling that has legal effects on you.

To use any of these rights, write to hello@galapagosecuadortrips.com. We answer within 15 days. We may ask you to confirm who you are first, to keep your information safe.

Our service is for adults (18 and over). If you give us details of other travellers, including children, you confirm that you may share them, for example as a parent or guardian. We do not knowingly collect information from children on their own.

Our site may link to other websites or open WhatsApp. Their own privacy rules apply there, not this policy. Please read them.

We may update this policy from time to time. We will change the date at the top of this page. If the change is important, we will also tell you on the site, or by email if we have your address.