Privacy Policy
Last updated: 7 August 2026
This Privacy Policy explains how ToDoInTheWorld Limited collects, uses, stores and shares personal data when you visit todointheworld.com, contact us or make a booking.
1. Data Controller
The data controller is:
ToDoInTheWorld Limited
Company No. 781967
1 Watermill Lawn
Raheny, Dublin, D05 K738
Ireland
Email: info@todointheworld.com
2. Personal Data We Collect
Depending on how you use our website or services, we may collect:
- first and last name;
- email address;
- telephone number;
- country or nationality, where relevant;
- booking information;
- selected experience, date, time and number of participants;
- special requests;
- communications sent by email, telephone or other contact methods;
- technical information relating to the use of our website, such as IP address, browser, device and pages visited;
- information concerning the status and amount of payments.
We do not normally store full payment card details.
3. Information About Other Participants
The person making a booking may provide information relating to other participants.
The person making the booking is responsible for ensuring that they are authorised to provide this information and that the other participants are informed about how their information may be used for the purpose of organising the experience.
4. How We Use Personal Data
We mainly use personal data to:
- respond to enquiries;
- create, manage and confirm bookings;
- arrange experiences with the relevant supplier;
- communicate meeting points, schedules and changes;
- process payments and refunds;
- provide customer support;
- manage cancellations and complaints;
- comply with tax, accounting and legal obligations;
- prevent fraud and misuse of our services;
- improve the operation of our website and services;
- measure the effectiveness of our advertising activities, where consent is required.
5. Legal Basis for Processing
We process personal data on one or more of the following legal bases.
Performance of a Contract
Processing may be necessary to respond to a request, take steps before entering into a contract or provide a booked service.
Legal Obligation
We may process or retain certain information where required to comply with legal, tax, accounting or regulatory obligations.
Legitimate Interests
We may process information where reasonably necessary for our legitimate business interests, including:
- providing customer support;
- maintaining booking records;
- preventing fraud;
- protecting our business and customers;
- improving our services;
- managing disputes and legal claims.
Consent
Where required by law, processing is based on your consent, particularly in relation to non-essential analytics, advertising cookies and tracking technologies.
You may withdraw your consent at any time.
6. Bókun and Our Booking System
ToDoInTheWorld uses Bókun as a technology platform for managing certain bookings and availability.
When you make a booking through a Bókun booking form or widget on our website, the information required to process your booking may be handled through Bókun’s systems.
This information may include:
- your name;
- email address;
- telephone number;
- number of participants;
- experience booked;
- date and time;
- information required for the operation of the booking.
Bókun processes data in accordance with its own applicable terms and privacy practices.
7. Payments
Online payments may be processed through specialist payment providers integrated with our booking systems.
Depending on the payment method used, such providers may include Stripe or other payment processors.
ToDoInTheWorld does not normally receive or store your full card number, card security code or full payment credentials.
We may receive and retain information such as:
- amount paid;
- payment date;
- currency;
- transaction status;
- transaction reference.
8. Experience Suppliers
Many experiences offered through ToDoInTheWorld are physically provided by independent local operators.
Where necessary to provide the booked service, we may share relevant booking information with the supplier, including:
- customer name;
- number of participants;
- necessary contact details;
- date and time;
- relevant operational requirements.
We only share personal data that is reasonably necessary for the provision of the service.
9. Dietary, Accessibility and Other Special Requirements
For some experiences, it may be necessary to receive information concerning:
- allergies or food intolerances;
- dietary requirements;
- accessibility requirements;
- circumstances relevant to safe participation in an activity.
Such information is requested or used only where reasonably necessary to organise and safely provide the service.
10. CookieYes and Consent Management
Our website uses CookieYes to collect and manage users’ cookie preferences.
When visiting our website, users may:
- accept all cookies;
- reject non-essential cookies;
- customise their preferences.
Cookie preferences may subsequently be changed through the cookie management tool available on the website.
11. Google Tag Manager, Google Analytics and Google Ads
Our website may use Google services for tag management, website analytics and advertising measurement, including:
- Google Tag Manager;
- Google Analytics;
- Google Ads and related conversion measurement tools.
These services may process information including:
- IP address;
- browser and device information;
- pages visited;
- interactions with the website;
- source of the website visit;
- events and conversions.
Where required by law, non-essential cookies and tracking technologies are activated only after the user has provided consent.
Users may reject or withdraw their consent through the website’s cookie management system.
12. Cookies
Strictly necessary cookies may be used without consent where permitted by law.
Analytics, advertising or other non-essential cookies are used in accordance with the preferences selected by the user and applicable data protection and electronic communications laws.
For detailed information about the cookies currently used on the website and their duration, users can consult the Cookie Settings / Cookie Preferences panel.
13. Marketing Communications
ToDoInTheWorld may send promotional communications only where permitted by applicable law.
Where consent is required, marketing communications will only be sent after valid consent has been obtained.
You may object to direct marketing at any time or use the unsubscribe option included in relevant communications.
14. Who We May Share Personal Data With
Where reasonably necessary, personal data may be shared with:
- experience suppliers;
- guides;
- transport providers;
- venues and facilities involved in an experience;
- Bókun;
- payment service providers;
- website hosting and IT service providers;
- Google and other analytics providers, where the required consent has been obtained;
- professional advisers;
- accountants;
- insurers;
- public authorities where disclosure is legally required.
15. International Data Transfers
Some technology providers may process personal data outside Ireland or the European Economic Area.
Where required by applicable law, international transfers are protected through recognised transfer mechanisms such as:
- adequacy decisions recognised under European Union law; or
- Standard Contractual Clauses approved by the European Commission.
16. Data Retention
We retain personal data only for as long as necessary for the purposes for which it was collected and to comply with applicable legal obligations.
Booking, payment, invoice and accounting records may generally be retained for at least six years, where required for applicable tax and accounting obligations.
Communications relating to complaints, disputes or legal claims may be retained for longer where reasonably necessary.
When personal data is no longer required, it will be deleted, anonymised or securely disposed of where reasonably practicable.
17. Security
We use reasonable technical and organisational measures designed to protect personal data against:
- loss;
- unauthorised access;
- misuse;
- alteration;
- unauthorised disclosure.
However, no Internet-based system or transmission can be guaranteed to be completely secure.
18. Children
Bookings must be made by an adult.
Personal data relating to minors may be processed where a child participates in an experience booked by a parent, guardian or other responsible adult.
We do not intentionally use children’s personal data for direct marketing.
19. Your Data Protection Rights
Subject to applicable legal conditions and limitations, you may have the right to:
- request access to your personal data;
- request correction of inaccurate personal data;
- request deletion of your personal data;
- request restriction of processing;
- object to certain processing;
- request data portability;
- withdraw consent;
- object to direct marketing.
To exercise any of these rights, please contact:
We may request reasonable information to verify your identity before responding to a request.
20. Complaints
You have the right to lodge a complaint with the:
Data Protection Commission (Ireland)
Depending on your circumstances, you may also have the right to contact the competent data protection authority in your country of residence.
21. Third-Party Websites
Our website may contain links to third-party websites, booking systems, payment services or external platforms.
Those third parties operate their own services and may apply their own privacy policies.
ToDoInTheWorld is not responsible for personal data processing independently carried out by third-party websites or services.
22. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to our services, technology or applicable legal requirements.
The updated version will be published on this page together with the date of the latest revision.
23. Contact Us
For any questions concerning privacy or the processing of personal data, please contact:
ToDoInTheWorld Limited
Company No. 781967
1 Watermill Lawn
Raheny, Dublin, D05 K738
Ireland
Email: info@todointheworld.com