Privacy Policy

01
Scope

This Policy covers website visits, enquiries, proposals, bookings, payments, travel arrangements, support, feedback and complaints. It also covers our business relationships with travel advisors, agencies, suppliers and partners.

A hotel, guide, transport provider, payment provider or other third party may separately process information for its own purposes. Its own privacy notice applies to that processing. This does not remove any responsibility VALE has for its own handling of personal data.

02
Personal Data We Collect

The information we collect depends on your interaction with VALE. We seek only information relevant to the enquiry, arrangement or other purpose concerned.

• Identity and contact details:
  names, country of residence, email addresses, telephone numbers, postal or billing addresses, and details of fellow travellers or emergency contacts.
• Enquiry and travel details:
  dates, destinations, group composition, rooming arrangements, budget, preferences, interests, arrival and pickup information, itinerary choices and feedback.
• Travel documents:
  nationality, date of birth, identification or passport details and visa information, including document copies only where reasonably required by law or a relevant supplier.
• Sensitive requirements:
  allergies, dietary requirements, medical conditions, mobility or accessibility needs, religious requirements or similar information you provide for a specific arrangement. Some of this information may be sensitive under applicable law.
• Payment and business records:
  billing details, payer information, transaction references, amounts, currencies, payment status, invoices, refunds, disputes and relevant partner or supplier records.
• Communications:
  emails, WhatsApp messages, call notes, requests, consents, support records, complaints and incident reports.
• Website information:
  IP address, browser and device information, pages viewed, referring pages, timestamps, approximate location derived from IP address, cookie identifiers and available consent or preference records.
• Marketing and preferences:
  communication choices, unsubscribe requests and travel preferences provided by you or inferred from your interactions with us.

03
How We Receive Information

We receive information directly from you through forms, email, telephone, WhatsApp and other agreed channels. We may also receive information from a lead traveller, family member, travel advisor, agency, supplier or payment provider involved in your arrangements.

Technical information may be collected when you use the website. For business relationships, we may obtain professional contact details from public business websites or other lawful sources where permitted by law.

If you provide another person’s information, please ensure that you are authorised to do so, that it is accurate, and that this Policy is made available to them. Where their consent is required, it must be given by that person or an authorised lawful representative.

04
How We Use Personal Data

We use personal data to respond to enquiries; prepare, price and revise proposals; check availability; arrange accommodation, guiding, transport, meals and activities; administer bookings and payments; handle changes, cancellations and refunds; and provide support before, during and after travel.

We also use relevant information to meet disclosed dietary, accessibility or safety needs; handle feedback, incidents and claims; prevent fraud and misuse; maintain accounting and legal records; secure and improve the website; and manage relationships with advisors, agencies and suppliers.

Marketing and advertising measurement are described separately below. We will not use personal data for a materially incompatible new purpose without providing any notice or obtaining any consent required by law. If information essential to an arrangement is not provided, we may be unable to prepare or deliver that arrangement.

05
Legal Bases for Processing

Where the applicable law requires a legal basis, we rely on the basis appropriate to the purpose and circumstances:

Where a jurisdiction does not use these legal-basis concepts, personal data is processed only as permitted by the law applicable to that processing.

06
Sensitive Data and Other Travellers

We limit sensitive information to what is reasonably needed for the relevant travel or safety purpose. Where required, we will request explicit consent before using or sharing it. A general enquiry or acceptance of this Policy does not replace any separate consent required by law.

You may withdraw consent at any time. Withdrawal does not affect processing already carried out lawfully, but may affect our ability to provide a requested arrangement safely. We will explain any practical impact with you.

Please do not send passport copies, medical records or other highly sensitive documents unless VALE or the relevant supplier specifically requests them for a legitimate purpose. Use the channel provided for that request.

07
Payments and Payment Providers

Netcoast LLC is the merchant of record for VALE bookings. The payment method, currency and provider will be identified on your invoice or payment request. Depending on the agreed method, payments may be processed through Stripe or received by bank transfer using Wise or the bank details provided.

When you use a Stripe-hosted payment page, full card details are entered with Stripe. VALE receives limited transaction information and does not receive or store the full card number or card security code from that hosted checkout. For bank transfers, we may receive payer details, bank or account information shown on the transfer, the amount, currency and payment reference.

Payment providers may also process information for their own compliance, fraud-prevention and service purposes. See the
Stripe Privacy Policy
and
Wise Privacy Notices.
Please do not send full payment-card details or security codes by email or WhatsApp.

08
Who We Share Information With

We share information only where reasonably necessary for the purposes described in this Policy. A supplier should receive only the information relevant to its role. Where a provider acts on our instructions, the applicable contractual and confidentiality protections are required.

• Travel providers:
  accommodation providers, guides, drivers, transport companies, restaurants, activity providers and local operators that need information to quote, confirm or deliver a requested service.
• Payment and technology providers:
  payment processors, banks, hosting, email, communications, storage, booking or customer-management services, security providers and measurement providers where used.
• Advisors and professional advisers:
  a travel advisor or agency acting for you, and our legal, accounting, insurance and other professional advisers.
• Authorities and safety recipients:
  regulators, courts, authorities, emergency responders or medical providers where disclosure is required by law or necessary on a lawful basis to protect people or rights.
• Business transactions:
  relevant parties to a proposed or completed reorganisation, financing or business transfer, subject to appropriate confidentiality and legal safeguards.

We do not sell personal data in exchange for money. Some disclosures to advertising or measurement providers may fall within legal definitions of sharing or targeted advertising in certain jurisdictions. The applicable choices and rights described below apply to that processing.

09
Cookies, Analytics and Advertising

The website uses Google Tag Manager to manage tags. Depending on the tools enabled and their configuration, services such as Google Analytics and Google Ads measurement may process device, usage, cookie or interaction information to understand website use and the effectiveness of advertising.

Cookies, pixels, local storage and similar technologies may support essential functions, preferences, analytics or advertising measurement. Essential technologies support functions such as security and form submission. Other technologies are subject to the consent or opt-out requirements applicable to their use.

Where consent is required, non-essential tracking is subject to your consent. You can use any cookie choices displayed on the website, adjust browser settings, and contact
support@valecurated.com
about available choices or privacy rights. Browser settings may affect website functions and do not necessarily control every form of tracking.

Where legally recognised browser-based opt-out signals apply, you may use those signals to exercise the relevant rights. Google explains its processing in the
Google Privacy Policy.
This Policy does not itself provide or record consent to non-essential tracking.

10
International Transfers

Netcoast LLC is established in the United States, while VALE’s travel arrangements and many suppliers are in Vietnam. Information may also be processed in other countries where relevant service providers or professional advisers operate. Privacy laws and government-access rules may differ between countries.

Where applicable law restricts an international transfer, the transfer must rely on a lawful mechanism and the safeguards required for the circumstances. Depending on the provider and transfer, this may involve an adequacy decision, approved contractual clauses, a recognised certification framework or another permitted mechanism, together with any required assessments or additional safeguards.

Contact
support@valecurated.com
to ask about the countries, recipients or safeguards relevant to your information, or to request a copy of applicable safeguards. Confidential or security-sensitive material may be redacted where permitted by law.

11
Data Retention

We retain personal data only for as long as reasonably necessary for the relevant purpose, legal obligations, disputes or enforcement of agreements. The following periods apply unless a justified legal or operational exception requires otherwise:

An unresolved claim, legal hold, court order or mandatory retention rule may require longer storage. Data no longer needed is deleted or anonymised. Protected backup copies may remain until overwritten in the ordinary backup cycle. Information that has been irreversibly anonymised may be retained.

12
Data Security

We use reasonable administrative, technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. Measures are selected according to the information, system and risk involved.

No transmission or storage system is completely secure. If a personal-data breach occurs, we will investigate and notify affected individuals and competent authorities where required by applicable law.

13
Your Rights and Choices

Your rights depend on the law applicable to the processing and any relevant conditions or exceptions. These may include the following:

• Request information about our processing and access to a copy of your personal data.
• Correct inaccurate or incomplete information and request deletion where the relevant conditions are met.
• Restrict or object to certain processing and receive eligible data in a portable format.
• Withdraw consent, unsubscribe from marketing, and exercise applicable opt-outs for sale, sharing or targeted advertising.
• Exercise any applicable rights concerning sensitive information, authorised agents, appeals or automated decisions.
• Complain to a competent privacy or data-protection authority without being required to contact VALE first.

Email
support@valecurated.com
with the subject
Privacy Request.
Describe the request and the email address, enquiry or booking concerned. We may request information reasonably needed to verify your identity or an agent’s authority, and will use it for that purpose.

We respond within the period required by applicable law. Where the EU or UK GDPR applies, the normal response period is one month; any lawful extension will be explained within that initial period. We will explain a refusal and any available complaint or appeal route. Exercising a privacy right will not result in unlawful discrimination.

EEA and UK residents may complain to the relevant data-protection authority, including the UK Information Commissioner’s Office where applicable. Vietnam residents may contact the competent Vietnamese authority. California rights, including applicable sale, sharing and sensitive-information rights, apply where the CCPA governs our processing.

14
Marketing Communications

We send marketing only where permitted by law and obtain consent where required. You can unsubscribe using the option in a marketing email or by contacting
support@valecurated.com.
We may keep a minimal suppression record to respect your choice.

Opting out of marketing does not prevent necessary communications about an enquiry, proposal, booking, payment, safety matter, complaint or journey.

15
Children and Minor Travellers

The website is intended for adults, and a person under 18 may not make a booking independently. A journey may include a minor where arranged by a parent, guardian or another appropriately authorised adult.

A minor’s information is collected only where reasonably necessary for travel arrangements, safety or legal compliance, through an authorised adult or as otherwise permitted by law. The adult must provide any consent they are legally authorised to give or arrange for the appropriate person to provide it. Contact us if you believe a child’s information has been provided without proper authority.

16
Automated Decisions

VALE does not currently make decisions about travellers based solely on automated processing that produce legal or similarly significant effects. Travel preferences may be used to tailor proposals and service. If our use of significant automated decisions changes, we will provide the notice and safeguards required by law.

17
Third-Party Websites and Services

The website and our communications may link to external websites, social platforms or other services. Their own privacy notices apply to their independent processing. Please review those notices before providing information to them.

18
Changes to This Policy

We may update this Policy when our services, providers, technology or legal obligations change. The revised version will be published here with an updated date. Where required, we will provide additional notice or obtain fresh consent before a material change takes effect.

19
Contact