Privacy Policy

Last updated: 25 August 2026

1. Who We Are

BMG Tours (“we,” “us,” or “our”) is a travel and tour operator registered in the Republic of South Sudan, operating from Juba. Our website is bmgtour.com. We are the data controller responsible for your personal data when you use our website or book our services.

2. Data We Collect

We may collect the following personal data:

  • Identity data: full name, date of birth, nationality, passport details
  • Contact data: email address, phone number, postal address
  • Booking data: travel dates, destination preferences, group size, dietary requirements, special needs
  • Payment data: transaction records (we do not store full card numbers — payments are processed securely by third-party providers)
  • Account data: email, encrypted password, booking history
  • Technical data: IP address, browser type, device information, pages visited (collected via analytics cookies)
  • Communications: messages you send us via forms, email, or WhatsApp

3. How We Use Your Data

We process your personal data for the following purposes:

  • To process and confirm your travel bookings
  • To communicate with you about your trips, itineraries, and bookings
  • To send booking confirmations, travel updates, and pre-departure information
  • To respond to your enquiries and provide customer support
  • To send marketing communications (only with your explicit consent)
  • To comply with legal and regulatory obligations
  • To improve our website and services through analytics
  • To process payments and maintain financial records

4. Legal Basis for Processing

We process your data under the following legal bases:

  • Contract performance: processing is necessary to fulfil your booking
  • Legitimate interest: improving our services, preventing fraud, ensuring security
  • Consent: sending marketing emails and setting non-essential cookies
  • Legal obligation: keeping financial records, responding to lawful requests

5. Cookies

We use cookies and similar tracking technologies to operate our website. Cookies fall into two categories:

  • Essential cookies: required for the website to function (authentication, security, session management). These cannot be disabled.
  • Analytics cookies: help us understand how visitors use our website so we can improve it. These are only set with your consent.

You can manage your cookie preferences at any time through the cookie consent banner displayed when you first visit our site.

6. Data Sharing

We may share your personal data with:

  • Service providers: airlines, hotels, ground transport operators, and guides — only the information necessary to fulfil your booking
  • Payment processors: to process your payments securely
  • Supabase: our secure database and authentication provider (hosted on AWS eu-west-1)
  • Resend: our email service provider for sending transactional and marketing emails
  • Government authorities: when required by law (e.g., visa applications, border control)

We do not sell, rent, or trade your personal data to third parties for their own marketing purposes.

7. Data Retention

  • Booking data: retained for 7 years to comply with financial record-keeping requirements
  • Account data: retained for as long as your account is active, plus 2 years after deletion
  • Marketing consent records: retained for 3 years after your last interaction
  • Analytics data: anonymised after 26 months

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including encryption in transit (TLS/SSL), secure authentication via Supabase Auth, and role-based access controls. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

9. Your Rights

Depending on applicable law, you may have the right to:

  • Access the personal data we hold about you
  • Correct inaccurate or incomplete data
  • Delete your personal data (subject to legal retention obligations)
  • Restrict how we process your data
  • Object to processing for direct marketing purposes
  • Withdraw consent at any time (where processing is based on consent)
  • Data portability — receive your data in a structured, machine-readable format

To exercise any of these rights, contact us at hello@bmgtour.com.

10. International Data Transfers

Your data may be processed in countries outside South Sudan (e.g., where our hosting providers operate — currently AWS eu-west-1 in Ireland). We ensure appropriate safeguards are in place for any such transfers.

11. Children's Privacy

Our services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has provided us with personal data, please contact us and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated “Last updated” date. We encourage you to review this policy periodically.

13. Contact

For any questions about this Privacy Policy or how we handle your data, contact us at: