Eating Europe Privacy Policy

Effective date: 22 September 2025
Last updated: 22 September 2025

This Privacy Policy explains how Eating Europe Inc. (“Eating Europe,” “we,” “us,” or “our”) collects, uses, discloses, and safeguards personal information when you use our websites, apps, and services, contact us, or otherwise interact with us (collectively, the “Services”). It also describes your rights and choices. This Policy includes region-specific disclosures for residents of the United States (by state), the European Economic Area (EEA), the United Kingdom (UK), and other jurisdictions where we operate.

Quick summary

We collect identifiers and contact details, booking and payment information, device and usage data, and communications you send us.
We use this data to operate our tours and experiences, handle bookings and payments, personalize content, provide customer support, market our offerings (with choices), improve the Services, secure our systems, and comply with law.
We share data with service providers (e.g., hosting, payments, analytics, marketing), partners involved in delivering your experiences, and as required by law.
We do not sell your personal information for money. Some advertising and analytics practices may be considered a “sale” or “sharing” or “targeted advertising” under certain U.S. state laws; you can opt out (see Your privacy rights & choices).
We honor Global Privacy Control (GPC) signals where required.
We use contracts and safeguards (e.g., Standard Contractual Clauses) for international transfers.
You have rights to access, delete, correct, and port your data, and to object/opt out of certain processing.

Who we are & contact details

Controller: Eating Europe Inc., a Delaware corporation.
Postal address: 1473 Schirra Drive, Ambler, PA 19002, USA (or your local office as shown on our website).
Email: [email protected]

If you are in the EEA/UK, you may contact your local supervisory authority; see How to contact authorities below.

What we collect

We collect information in three ways: (1) directly from you, (2) automatically through your device/browser, and (3) from third parties (e.g., booking platforms, travel agents, payment processors, marketing partners).

Personal information we collect may include:

Identifiers and contact details: name, email, phone number, postal address, account credentials.
Booking & transaction details: itinerary, reservations, order history; payment card details are processed securely by our payment processors. We do not store full card numbers; we only retain a token and/or the last four digits for record-keeping and refunds.
Demographics & preferences: nationality, preferred city/experiences, dietary restrictions or accessibility needs you choose to share.
User content & communications: messages to us, reviews, survey responses, photos or media you upload.
Device & usage data: IP address, cookie identifiers, advertising identifiers, browser type, operating system, language, referring/exit pages, pages viewed and links clicked, approximate location from IP, and similar technical data.
Inferred data: interests or segments derived from other data to personalize content or offers.
Sensitive information (limited): information you provide about dietary restrictions, allergies, or accessibility needs. We ask that you do not provide medical, biometric, or other sensitive data beyond what is necessary to arrange your experience.

We may aggregate or de-identify personal information so it can no longer reasonably identify you. We may use and disclose such data for any purpose.

How we use personal information

We use information for the following purposes and legal bases:

Provide and improve the Services (performing a contract; our legitimate interests), including handling enquiries, bookings, tickets, itineraries, customer support, and partner coordination.
Payments and fraud prevention (performing a contract; legal obligations; legitimate interests).
Personalization and analytics (legitimate interests; consent where required) to understand usage and improve content.
Marketing and advertising (consent where required; legitimate interests) including email newsletters, promotions, and online advertising. You can opt out anytime.
Security and integrity (legitimate interests; legal obligations) including monitoring, detecting, and preventing security incidents.
Compliance with applicable laws, responding to lawful requests, enforcing our terms, or protecting rights.

Automated tools/AI: We may use automated systems (including AI) to help detect fraud, route support requests, and personalize recommendations. We do not use solely automated decision-making that produces legal or similarly significant effects without providing required notices and choices.

Cookies, analytics & advertising

We use cookies, pixels, SDKs, and similar technologies for essential site functions, to measure traffic and performance, and to deliver and measure ads. You can manage your preferences via our Cookie Preferences tool and your browser/device settings. Where required by law, we obtain consent before setting non-essential cookies. See also Your privacy rights & choices.

Global Privacy Control (GPC) & universal opt-out signals: Where required by law, if your browser or extension sends a recognized opt-out preference signal (e.g., GPC), we treat it as a valid request to opt out of the sale/sharing of personal information or targeted advertising for that browser.

When we share information

We share personal information with:

Service providers/Processors that act on our instructions (e.g., hosting, cloud storage, payment processing, booking/CRM, analytics, advertising, email/SMS delivery, customer support, security).
Experience partners (e.g., local guides, venues) to fulfil your booking.
Business transfers in connection with a merger, acquisition, or asset sale.
Legal/compliance purposes (e.g., to regulators or law enforcement), or to protect us, you, or others.

We do not permit service providers to use your information for their own independent purposes.

International transfers

If you access the Services from outside the United States, your information may be transferred to, stored, or processed in countries that may not provide the same level of protection.

When we transfer personal information internationally, we rely on appropriate safeguards, such as EU Standard Contractual Clauses (and the UK Addendum/IDTA) and, where applicable, vendors’ certification under the EU–U.S. Data Privacy Framework (and UK Extension/Swiss-U.S.). We also conduct transfer risk assessments as appropriate.

Data retention

We retain personal information for as long as needed for the purposes described above, including to comply with legal, accounting, or reporting obligations, resolve disputes, and enforce agreements.

Typical retention periods include:

Booking and transaction records: up to 7–10 years (to satisfy tax/audit laws).
Customer service communications: up to 3 years after last interaction.
Marketing preferences and email subscription records: until you unsubscribe or your request is fulfilled, plus a short period to maintain suppression lists.
Website analytics logs: up to 25 months (unless a longer period is needed for security or legal reasons).

We may retain de-identified or aggregated data without time limits.

Your privacy rights & choices (global)

Depending on where you live, you may have some or all of the following rights:

Access the personal information we hold about you.
Correction of inaccurate or incomplete information.
Deletion of your personal information.
Portability of your information in a commonly used format.
Restriction/Objection to certain processing (including direct marketing).
Withdraw consent where we rely on consent.
Opt out of: (i) the sale or sharing of personal information; (ii) targeted advertising; and/or (iii) certain profiling/automated decisions (where applicable).

You can exercise rights by emailing [email protected] or using the tools/links on our site (e.g., Your Privacy Choices). We will verify your request and respond within the timeframes required by law.

Where available, you may designate an authorized agent to submit a request on your behalf. We will not discriminate against you for exercising your rights.

Appeals: If we deny your request (in whole or in part), you may appeal by replying to our decision or writing to [email protected] with the subject line Privacy Request Appeal. If you are dissatisfied with our response, you may contact your state attorney general or data protection authority.

U.S. State Privacy Notice

The following disclosures apply to U.S. residents in states with comprehensive privacy laws (including, as of the effective date, CA, CO, CT, DE, FL*, IA, IN, MD, MN, MT, NE, NH, NJ, OR, TN, TX, UT, VA, and others as they become effective). These laws generally apply based on where you reside, not our place of incorporation.

Categories of personal information we collect (California terminology): Identifiers (e.g., name, email, phone, device and cookie IDs), Customer records (billing details), Commercial information (bookings, purchases), Internet/Network activity, Geolocation (approximate), Inferences, and Sensitive information you choose to provide (dietary/accessibility). We do not knowingly collect precise geolocation, social security numbers, or biometric identifiers.

Sources & purposes: See What we collect and How we use above. We also disclose the following for transparency: we use advertising and analytics partners that may collect data across sites and apps to help us measure and improve ads (which some state laws define as a “sale,” “share,” or “targeted advertising”).

Disclosures for a business purpose / recipients: In the past 12 months, we disclosed the categories above to service providers for business purposes such as hosting, payment processing, analytics, advertising/marketing, customer support, security, and fraud prevention; to experience partners to fulfill bookings; and to authorities when required by law.

We do not knowingly sell or share the personal information of consumers under 16.

Your U.S. state rights:

Right to know/access specific pieces and categories of personal information.
Right to delete personal information.
Right to correct inaccuracies.
Right to opt out of sale/sharing and targeted advertising, and to limit use of sensitive personal information where applicable (e.g., California).
Right to appeal a decision on your request.

Opt-out preference signals (GPC/UOOM): Where required, we honor recognized browser-based signals as a valid request to opt out for that browser/device.

How to exercise: Use the Your Privacy Choices link in our footer or email us at [email protected]. For California residents, you may also use an authorized agent and we will take steps to verify your agent’s authority.

California metrics & financial incentives: If we ever offer a program that provides discounts or rewards in exchange for personal information (a “financial incentive”), we will provide a separate notice describing the material terms and obtain your opt-in consent. We do not offer such a program today. We are not required to publish request metrics but may do so in the future.

Children’s privacy

Our Services are intended for general audiences and are not directed to children. We do not knowingly collect personal information from children under 13 (U.S.) or under 16 (EEA/UK) without appropriate consent. If you believe a child has provided personal information to us, please contact us and we will take appropriate action.

EEA/UK legal bases & your rights

Where the GDPR/UK GDPR applies, our legal bases include performance of a contract (to provide bookings and customer service), legitimate interests (e.g., to improve services, prevent fraud, and market to customers), consent (e.g., non-essential cookies, certain marketing, and processing of any sensitive data you choose to share), and compliance with legal obligations.

You have the rights to access, rectify, erase, restrict, port, and object to processing (including direct marketing), and to withdraw consent. You also have the right to lodge a complaint with your local authority (see links below).

Security

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, access controls, and regular monitoring. No system is 100% secure; please use strong, unique passwords and let us know immediately if you suspect unauthorized activity.

Email & SMS marketing

Where permitted, we may send you promotional emails or SMS messages. You can opt out of marketing emails by clicking “unsubscribe” in the message or contacting us. For SMS, reply STOP to opt out or HELP for help. Message and data rates may apply.

How to contact authorities

EU/EEA: See the list of supervisory authorities at https://edpb.europa.eu/about-edpb/about-edpb/members_en
UK: Information Commissioner’s Office (ICO): https://ico.org.uk/
U.S.: You may contact your state Attorney General’s office.

Changes to this Policy

We may update this Policy from time to time. We will post the updated version and change the “Last updated” date. If changes materially affect your rights, we will provide additional notice as required by law.

How to contact us

Questions or requests? Email [email protected] or write to the address listed in Who we are above.

Additional disclosures (jurisdiction notes)

Washington My Health My Data (MHMDA): We do not offer services that involve processing of consumer health data beyond basic dietary or accessibility preferences you choose to provide for your booking. If that changes, we will provide a specific notice and obtain any required consent.
Nevada: We do not currently engage in the “sale” of covered information as defined by Nevada law. Nevada residents may nevertheless submit a sale opt-out request to [email protected].
Canada: We process personal information in accordance with applicable Canadian laws (e.g., PIPEDA) when dealing with Canadian residents; you may contact the Office of the Privacy Commissioner of Canada.

Note: This Policy is intended to be clear and compliant across jurisdictions, but your specific rights and our obligations can vary by state/country. If anything here conflicts with local law, we will follow the law for residents of that jurisdiction.

Privacy Policy