GDPR Compliance

Last Updated: June 26, 2026

Our Commitment to Data Protection

While neo-bear operates primarily in Australia, we recognize the importance of protecting the personal data of all our users, including those from the European Union. This page outlines our compliance with the General Data Protection Regulation (GDPR) principles.

Legal Basis for Processing

We process personal data based on the following legal grounds:

• Consent: When you provide explicit consent for specific processing activities
• Contract Performance: Processing necessary to fulfill booking agreements
• Legitimate Interests: For business operations that do not override your rights
• Legal Obligations: When required by applicable laws and regulations

Your GDPR Rights

If you are a resident of the European Union, you have the following rights:

• Right to Access: Request copies of your personal data
• Right to Rectification: Request correction of inaccurate data
• Right to Erasure: Request deletion of your personal data under certain conditions
• Right to Restrict Processing: Request limitation of how we use your data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests or direct marketing
• Right to Withdraw Consent: Withdraw previously given consent at any time

Data Collection and Use

We collect only the personal data necessary for providing our services. This includes:

• Contact information for booking confirmations and communications
• Booking preferences to deliver appropriate tour experiences
• Payment information processed through secure, compliant payment processors
• Website usage data to improve user experience

Data Sharing and International Transfers

We do not sell your personal data. When data is shared with service providers, we ensure appropriate safeguards are in place. Any international data transfers comply with GDPR requirements through:

• Standard contractual clauses approved by the European Commission
• Adequacy decisions where applicable
• Other legally recognized transfer mechanisms

Data Security Measures

We implement technical and organizational security measures including:

• Encryption of data in transit and at rest
• Access controls and authentication requirements
• Regular security assessments and updates
• Staff training on data protection principles
• Incident response procedures for data breaches

Data Retention

Personal data is retained only as long as necessary for the purposes outlined in our Privacy Policy or as required by law. When data is no longer needed, it is securely deleted or anonymized.

Cookies and Tracking

We use cookies in compliance with GDPR requirements. You can manage cookie preferences through our cookie banner and browser settings. See our Cookie Policy for detailed information.

Marketing Communications

Marketing communications are sent only with your explicit consent. You can unsubscribe at any time through links provided in communications or by contacting us directly.

Children's Privacy

Our services are not directed at children under 16. We do not knowingly collect personal data from children without parental consent.

Exercising Your Rights

To exercise any of your GDPR rights, please contact us at:

Email: [email protected]

We will respond to requests within one month, as required by GDPR. In complex cases, this period may be extended by two additional months with notification.

Supervisory Authority

If you believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local data protection supervisory authority in the European Union.

Updates to This Information

We may update this GDPR compliance information to reflect changes in our practices or legal requirements. Significant changes will be communicated through appropriate channels.

Contact Information

For questions about GDPR compliance or data protection practices:

Email: [email protected]
Location: Sydney, NSW, Australia