Provider Data Protection & Customer Privacy Terms

Last Updated: 5 October 2026

Customer trust is essential to Eazy Book It. These Provider Data Protection & Customer Privacy Terms (“Provider Privacy Terms”) apply whenever a Provider receives, views, downloads, uses or otherwise processes customer or traveller personal information through Eazy Book It.

Eazy Book It is operated by Bahrain Fun Tours W.L.L., Kingdom of Bahrain. These Provider Privacy Terms form part of the conditions governing a Provider's access to and use of the Eazy Book It Platform and should be read together with any Provider agreement, Platform terms, privacy requirements and applicable law.

Providers must handle customer information carefully, confidentially and only for legitimate purposes connected with the relevant booking or another purpose independently permitted by applicable law.

1. Scope and Provider Responsibility

These terms apply to personal information made available through Provider dashboards, booking records, emails, reports, support communications, APIs, exports or any other Eazy Book It feature. Each Provider is responsible for ensuring that its owners, employees, representatives, contractors and authorized users comply with these requirements.

Depending on the circumstances and applicable law, a Provider may act as an independent data controller or may process certain information on behalf of another party. Nothing in these terms removes a Provider's independent legal obligations.

2. Permitted Use

Providers may access and use customer information only to the extent reasonably necessary to:

• Confirm, administer and fulfil bookings;
• Provide the booked service safely and effectively;
• Communicate necessary operational information about a booking;
• Arrange pickup, drop-off, transportation, admission or other booked arrangements;
• Manage authorized amendments, cancellations or refunds;
• Address customer-support issues, complaints or service recovery;
• Maintain records required by applicable law; or
• Establish, exercise or defend legitimate legal rights.

Providers should use the minimum personal information reasonably necessary for the relevant purpose.

3. Prohibited Use

Customer information obtained through Eazy Book It must not be treated as a general marketing database or used for unrelated commercial purposes. Unless independently permitted by applicable law, Providers must not:

• Sell, rent or trade customer information;
• Disclose it to unauthorized third parties;
• Add customers to marketing, messaging or promotional lists without an appropriate legal basis;
• Send unsolicited marketing or promotional communications;
• Use customer information to bypass Eazy Book It for unrelated solicitation or improper off-platform activity;
• Collect or request personal or sensitive information that is not reasonably required;
• Use information for profiling, advertising or unrelated analytics without a lawful basis;
• Attempt to access customer information outside the Provider's authorized bookings or permissions; or
• Retain personal information longer than reasonably necessary or legally required.

4. Confidentiality and Access Control

Providers must keep customer information confidential and limit access to personnel who reasonably need it to administer or deliver the relevant service. Personnel with access should receive appropriate privacy and security guidance and be subject to confidentiality obligations where appropriate.

Customer information must not be copied, downloaded, printed or shared more widely than reasonably necessary for the booking or a lawful business requirement.

5. Security Measures

Providers must maintain reasonable technical and organizational safeguards appropriate to the nature of the information and the risks involved. Measures should include, where appropriate, access controls, strong authentication, secure devices and networks, software updates, malware protection, secure storage, controlled backups and secure disposal.

Providers must take reasonable steps to prevent unauthorized access, accidental disclosure, alteration, loss, destruction or misuse of customer information.

6. Provider Account Security

Providers are responsible for protecting their Eazy Book It account credentials and for activity performed through authorized Provider accounts. Passwords and authentication credentials must not be shared with unauthorized persons.

A Provider must notify Eazy Book It promptly if it suspects account compromise, unauthorized access or misuse of customer information and must take reasonable steps to secure the affected account.

7. Third Parties and Subcontractors

A Provider may disclose customer information to a subcontractor or other third party only where reasonably necessary for the booked service or another lawful purpose, and only where the disclosure complies with applicable law.

Where a third party processes customer information on the Provider's behalf, the Provider is responsible for using appropriate contractual, confidentiality, security and data-protection safeguards. Providers remain responsible for their own selection and management of such parties.

8. Data Breaches and Security Incidents

If a Provider becomes aware of suspected or confirmed unauthorized access, disclosure, loss, alteration, destruction or misuse of customer information received through Eazy Book It, the Provider must notify Eazy Book It without undue delay.

The Provider must provide information reasonably available about the incident, the information and individuals affected, likely consequences, containment steps and corrective measures, and must reasonably cooperate with investigation, customer protection, regulatory assessment and any notification obligations required by law.

Providers should preserve relevant evidence and must not conceal, destroy or improperly alter records relating to a security incident.

9. Customer Privacy Requests

Where a customer or traveller exercises a privacy right concerning information associated with an Eazy Book It booking, the Provider must reasonably cooperate with Eazy Book It where necessary to respond appropriately and within applicable legal requirements.

If a Provider receives a request that relates primarily to Eazy Book It's processing, it should direct or forward the request to Eazy Book It without unnecessary delay, while respecting applicable confidentiality and legal requirements.

10. Accuracy and Data Minimization

Providers should take reasonable steps to keep customer information used for a booking accurate and relevant. Providers must not intentionally alter booking information in a misleading manner or collect excessive information merely because it is technically possible to do so.

11. International Processing and Transfers

Providers must comply with applicable requirements governing transfers of, or remote access to, personal information outside the Kingdom of Bahrain or any other relevant jurisdiction. A Provider must not transfer customer information internationally merely for convenience where the transfer would violate applicable data-protection requirements.

Where safeguards, approvals, contractual measures or other transfer mechanisms are required by law, the Provider is responsible for ensuring they are in place for transfers made under its control.

12. Retention, Return and Deletion

Providers should retain customer information only for as long as reasonably necessary to deliver and administer the service and meet legitimate legal, accounting, tax, regulatory, fraud-prevention or dispute requirements.

When personal information is no longer required, the Provider should securely delete, destroy, return or anonymize it as appropriate. Termination of a Provider relationship does not authorize continued use of previously obtained customer information for unrelated purposes.

13. Direct Collection from Customers

If a Provider independently collects additional personal information directly from a customer, the Provider is responsible for ensuring that collection is lawful, transparent and limited to what is reasonably necessary. Where required, the Provider must provide its own privacy information and obtain any necessary consent.

Providers should not ask customers to send passwords, one-time passwords, complete payment-card credentials or other authentication secrets through ordinary messaging channels.

14. Payment and Financial Information

Providers must not request or store complete payment-card credentials obtained outside authorized payment processes unless independently authorized and legally permitted to do so. Payment-related information visible through Eazy Book It must be treated as confidential and used only for legitimate booking, reconciliation, refund, dispute or accounting purposes.

15. Provider's Independent Legal Obligations

Providers remain responsible for complying with privacy, data-protection, cybersecurity, consumer and sector-specific laws applicable to their operations. Where Bahrain law applies, this includes applicable requirements under Law No. (30) of 2018 with Respect to Personal Data Protection and its implementing decisions.

If a Provider's local law imposes a higher or additional requirement, the Provider must comply with that requirement as well.

16. Cooperation and Compliance Information

Eazy Book It may reasonably request information necessary to assess compliance with these Provider Privacy Terms, investigate a customer complaint or security incident, or satisfy a legal or regulatory requirement. Providers must provide reasonable and truthful cooperation, subject to applicable law.

17. Compliance Measures

We prefer to resolve privacy and security concerns quickly and fairly. However, serious or repeated misuse of customer information may result in proportionate measures including:

• Security verification or corrective-action requirements;
• Restriction of access to customer information or Provider features;
• Temporary suspension;
• Removal from Eazy Book It;
• Termination of the Provider relationship; or
• Notification to affected parties, payment partners, insurers, regulators or competent authorities where required or permitted by law.

These measures are without prejudice to other rights or remedies available under contract or applicable law.

18. Continuing Obligations

Confidentiality, security, retention/deletion and restrictions on unauthorized use continue to apply to customer information retained after a booking is completed or after the Provider relationship ends, for as long as the Provider holds that information.

19. Changes to These Terms

We may update these Provider Privacy Terms to reflect changes in the Platform, technology, business practices or legal requirements. The current version will be published through Eazy Book It with an updated date. Where required, Providers may receive additional notice of material changes.

20. Contact

For privacy, security or customer-data questions relating to Eazy Book It:

Eazy Book It
Bahrain Fun Tours W.L.L.
Kingdom of Bahrain
Website: eazybookit.com
Privacy & Data Protection: support@eazybookit.com