Privacy policy
This policy explains what personal information Tino Boats collects when you use tinoboats.com or book with us, why, who we share it with and the choices you have. We keep it short and only collect what we need to run your trip.
Who we are
Tino Boats Ltd, Route Royale, Le Maho, Trou d'Eau Douce 42208, Mauritius, is responsible for your personal information (the "controller" under the Mauritius Data Protection Act 2017 and, for visitors from the European Union or the United Kingdom, the GDPR). Contact us about anything in this policy at info@tinoboats.com or on +230 490 4100.
What we collect
When you book or send a request:
- your name, email address, phone or WhatsApp number and nationality;
- the trip, date, departure time, the number of adults, children and babies, and any extras you choose;
- anything you write in the message box (for example your hotel for a pickup, or a dietary need);
- where you heard about us, if you tell us;
- the payment status, amount and reference of your booking.
We do not see or store your card number. You enter your card details on the secure payment page of MIPS, our payment gateway, which handles them under the card industry's PCI DSS security standard and tells us only whether the payment succeeded.
To protect the booking and request forms from abuse, we use the internet (IP) address your request comes from to limit repeated attempts. We store it only as a one-way hash, which cannot be turned back into the address.
If you contact us by WhatsApp, phone or email, we keep that conversation to answer you.
Why we use it
- To take, confirm and run your booking: holding your seats, taking payment, sending your confirmation, organising pickups and contacting you about your trip, including weather changes. This is needed to perform our contract with you.
- To answer your requests and questions, at your request.
- To keep accounting and tax records, which the law requires.
- To keep the website secure and prevent fraud and spam, which is in our legitimate interest and yours.
We do not sell your information, and we do not use it for advertising. We only send you marketing if you ask us to.
Who we share it with
We share your information only with the service providers that help us run the website and your booking, each of whom may use it only for that purpose:
- MIPS (Mauritius): card payments;
- Odoo: our booking and customer management system, used by our reservations team;
- Supabase: the database that stores bookings and requests (servers in London, United Kingdom);
- Vercel: hosting of this website;
- Resend: sending booking emails;
- Google Workspace: our email inbox;
- Cloudflare Turnstile: the security check on our forms, which looks at your browser and IP address to tell people from automated bots.
If you booked through a partner (a hotel, a travel agency, GetYourGuide, Viator or similar), that partner shares your booking details with us and its own privacy policy also applies.
We may also disclose information when the law requires it, for example to the authorities in Mauritius.
International transfers
Some of these providers store or process information outside Mauritius, including in the United Kingdom, the European Union and the United States. We use providers that protect personal information with appropriate safeguards, such as standard data protection contract clauses.
How long we keep it
- Bookings: for as long as Mauritian accounting and tax law requires us to keep the records.
- Requests that did not become a booking: up to 2 years, then deleted.
- Messages with our team: as long as needed to deal with your enquiry or booking.
Cookies and similar technology
This website uses no advertising or analytics cookies. It stores only what it needs to work:
- your display currency (MUR, EUR or USD), remembered in your browser;
- a sign-in cookie for our staff when they use the site's admin area.
Some pages show content from other services, which may set their own cookies when it loads: Google Maps on our landing pages, and YouTube videos once you press play. The security check on our forms comes from Cloudflare.
Your rights
You can ask us at any time to:
- see the personal information we hold about you and get a copy;
- correct anything that is wrong;
- delete your information, unless we have to keep it by law (for example accounting records);
- stop or limit a use of your information, or object to it.
Email info@tinoboats.com and we will reply within one month. If you are not satisfied with our answer, you can complain to the Data Protection Office of Mauritius (dataprotection.govmu.org) or to the data protection authority in your own country.
Children
Our trips are for families, but bookings are made by adults. We only ask how many children and babies are in your group, not for their names or other details.
Security
The website uses an encrypted connection (HTTPS) throughout. Access to booking information is limited to our team and the providers above, and staff accounts are password protected.
Changes to this policy
If we change this policy, we will publish the new version on this page. The policy in force when you book applies to your booking.
Last updated: 11 November 2026.