Privacy Policy

1. Introduction and data controller

EME International SARL ("EME," "we," "us," or "our") operates the EME website and tour-operator services. This Privacy Policy explains how we collect, use, store, and protect your personal information, and the rights you have over that information under the EU General Data Protection Regulation (GDPR), applicable national data protection laws, and — where you access the service from the United States — applicable US state privacy laws.

Data controller: EME International SARL, a company registered in Lebanon, 4th Floor, Final Touch Spa Building, Fanar Main Road, Lebanon. Registry code: 2012754 (Mount Lebanon Commercial Register).

For privacy questions, data-subject requests, or to contact our data-protection point of contact, email [email protected]. We aim to respond within five business days and to fulfil rights requests within one month, extendable by a further two months for complex requests (GDPR Article 12).

2. Information we collect

We collect the following categories of information:

• Account information:Name, email address, and hashed password when you create an account; profile photo if you upload one; OAuth identifier when you sign in with a third-party provider (e.g. Google).
• Travel preferences: Up to three selected interests, budget tier, and travel style indicators used to personalise destination recommendations.
• Trip data: Countries, cities, itinerary items, dates, flight searches, hotel selections, and notes you save to your trips.
• Recommender prompts: Free-text descriptions you submit to the Europe Recommender, together with the resulting recommendation output.
• Payment metadata: When you purchase the Recommender unlock or a package booking, our payment processor (Stripe) handles your card details directly. We receive only the transaction reference, amount, currency, and status — never your full card number.
• Usage data: Pages visited, features used, referrer, and interaction patterns to operate and improve the service.
• Device and connection data: Browser type, operating system, screen size, language, approximate location derived from IP, and IP address itself for security, abuse prevention, and analytics.

What we do not collect. We do not knowingly collect special categories of personal data under GDPR Article 9 (health, race, religion, sexual orientation, biometric or genetic data, political opinions, trade-union membership). Please do not submit such information through trip notes, prompts, or support messages. If accessibility-related information is necessary for performing a package booking, we will collect only the minimum needed and with your explicit consent.

3. Legal basis for processing

We process personal data only where we have a lawful basis under GDPR Article 6:

Where we rely on legitimate interests, we balance those interests against your rights and freedoms. You may object to processing based on legitimate interests at any time — see section 13.

4. How we use your information

• To create and manage your account.
• To generate personalised itineraries and destination recommendations based on your stated preferences and prompts.
• To save and restore your trips and itinerary progress across sessions and devices.
• To process payments and fulfil package bookings, including communicating with suppliers (hotels, transport, guides) only to the extent needed to deliver the booked services.
• To improve the platform, debug, and develop new features — using aggregated or pseudonymised data where possible.
• To communicate with you about your account, transactional updates, and support requests.
• To send marketing emails — only with your separate, opt-in consent (see section 12).
• To comply with legal obligations and enforce our terms.

6. Cookies and similar technologies

We use a small number of cookies and equivalent client-side storage mechanisms. Cookies that are not strictly necessary are loaded only with your consent, recorded through our cookie banner. You can change your choice at any time by clearing theeme_cookie_consentvalue in your browser's site-data settings, which will cause the banner to reappear.

We honour the Global Privacy Control (GPC) signal sent by your browser as a request to opt out of non-essential tracking and the sale or sharing of personal information.

7. Sub-processors and third-party services

We rely on carefully selected sub-processors to operate the service. Each is bound by a written data-processing agreement meeting GDPR Article 28 requirements:

We never sell your personal information. We do not share personal data with data brokers, ad networks, or any party other than the sub-processors listed above. An up-to-date list of sub-processors is available on request from [email protected].

8. Data storage and security

Personal data is stored in encrypted databases in the European Economic Area, with access restricted to authorised systems and personnel under written confidentiality obligations. Passwords are hashed using industry-standard algorithms and are never stored in plain text. We use TLS for data in transit, role-based access controls, audit logging, and least-privilege principles. We regularly review our technical and organisational measures against ENISA guidance and update them as the threat landscape evolves.

9. Data retention

We retain personal data only for as long as needed for the purpose it was collected, or as required by law:

Where a legal obligation requires us to retain data after you have asked us to delete it, we will restrict its processing to that obligation only and erase it once the period expires.

10. International transfers

Where personal data is transferred outside the European Economic Area — for example to sub-processors listed in section 7 — EME relies on a lawful transfer mechanism: an adequacy decision (e.g. the EU-US Data Privacy Framework for participating US recipients, or the Commission adequacy decision for Canada), Standard Contractual Clauses combined with a documented Transfer Impact Assessment, or another mechanism permitted under GDPR Chapter V. A copy of the relevant safeguards is available on request from [email protected].

11. Automated decision-making and AI

The Europe Recommender uses AI. When you submit a prompt to the Recommender, EME forwards it together with selected preferences (interests, budget tier, traveller type) to a large language model operated by Anthropic, which returns scored destination matches. The router uses your prompt to extract travel concepts and to rank options in our destination catalogue.

How decisions are made. The output is a recommendation, not a binding decision. You remain in control of every choice — whether to view a destination, save a trip, or proceed to checkout. We do not use the Recommender to deny services, set prices on an individual basis, or take other consequential automated decisions about you. Accordingly, GDPR Article 22 (automated individual decisions with legal or similarly significant effects) does not apply, but we still afford you the right to obtain an explanation, contest a result, and request a human review at [email protected].

EU AI Act transparency. The Recommender is a general-purpose AI system used for limited-risk personalisation within the meaning of the EU AI Act. You are interacting with an AI system whenever you see Recommender output. AI is not used in our package-travel decision-making, complaints handling, or customer-support conversations.

No training on your data.Anthropic operates under a zero-retention configuration for our traffic, and your prompts and outputs are not used to train Anthropic's models, EME's models, or any third party's models. We do not sell prompts or outputs to data brokers.

12. Marketing communications

We send marketing emails — such as new-destination announcements, seasonal offers, or product news — only where you have given separate, explicit opt-in consent (for example by ticking a newsletter checkbox at sign-up or in your profile). Every marketing message contains a one-click unsubscribe link. You can also withdraw consent at any time from your profile settings or by emailing [email protected]. Withdrawing consent does not stop transactional or service-critical messages (booking confirmations, password resets, security alerts), which are sent on the contractual basis in section 3.

13. Your rights under GDPR

You have the right to:

• Access the personal data we hold about you (Art. 15).
• Rectify inaccurate or incomplete data (Art. 16).
• Erase your account and associated data, subject to legal-retention exceptions (Art. 17).
• Restrict processing in defined circumstances (Art. 18).
• Port your trip data to another service in a machine-readable format (Art. 20).
• Object to processing based on legitimate interests, including profiling (Art. 21).
• Withdraw consent for any consent-based processing at any time, without affecting prior lawful processing (Art. 7(3)).
• Not be subject to a solely automated decision producing legal or similarly significant effects (Art. 22).
• Lodge a complaint with a supervisory authority.

To exercise any of these rights, contact us at [email protected]. You also have the right to lodge a complaint with the data protection supervisory authority in your EU member state of residence.

14. US state privacy rights

If you are a resident of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, or another US state with a comprehensive consumer-privacy law, you may have additional rights including:

• The right to know what categories of personal information we have collected, used, disclosed, and to whom.
• The right to correct or delete personal information.
• The right to opt out of the sale or sharing of personal information for targeted advertising. EME does not sell or share personal information for cross-context behavioural advertising.
• The right to limit the use of sensitive personal information. EME does not knowingly process sensitive personal information beyond what is strictly necessary to deliver a booked service.
• The right not to be discriminated against for exercising these rights.

To exercise a US-state right, email [email protected] with the subject line "US state privacy request" and your state of residence. We will verify your identity through your registered email before fulfilling the request. We do not charge a fee for exercising these rights and we do not discriminate against consumers who exercise them.

15. Data-breach notification

In the event of a personal-data breach likely to result in a risk to your rights and freedoms, EME will notify the competent data protection supervisory authority without undue delay and where feasible within 72 hours of becoming aware of the breach, in line with GDPR Article 33. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay, in line with Article 34, describing the nature of the breach, the likely consequences, and the measures we are taking.

16. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated through a prominent notice on the platform and, where you have an account, by email at least 14 days before they take effect. We will keep prior versions available on request. Continued use of EME after changes take effect constitutes acceptance of the updated policy. We encourage you to review this page periodically.