Mystical Trips
PRIVACY POLICY
Last Updated: August 2026
Mystical Trips respects your privacy and is committed to handling personal data responsibly, transparently and securely.
This Privacy Policy explains what information we collect, why we collect it, how we use it, when it may be shared, how long it may be retained and what choices may be available to you.
This Policy applies when you:
Visit our website;
Submit an enquiry;
Request an itinerary or quotation;
Make or manage a booking;
Communicate with us;
Participate in an experience;
Subscribe to marketing communications;
Interact with our social-media accounts; or
Otherwise provide personal data to Mystical Trips.
1. WHO CONTROLS YOUR PERSONAL DATA?
The controller responsible for your personal data is:
Mystical Trips
Registered Address: POB 65, PC 112
Privacy Email: contact@mysticaltrips.com
Telephone: +968 99855885
Where required, the details of our appointed Personal Data Protection Officer or responsible privacy contact will be published here:
Privacy Contact/Data Protection Officer: Mr. Ahmed Al Rashdi
Email: ahmed@mysticaltrips.com
2. PERSONAL DATA WE MAY COLLECT
The personal data collected depends on how you interact with us.
2.1 Identification and Contact Information
We may collect:
Full name;
Nationality;
Country of residence;
Email address;
Telephone or WhatsApp number;
Postal address;
Passport or identification information where necessary;
Date of birth or age; and
Preferred language.
2.2 Booking and Travel Information
We may collect:
Preferred travel dates;
Number and age of participants;
Accommodation or collection address;
Requested destinations and activities;
Travel preferences;
Itinerary details;
Arrival or departure information;
Luggage requirements;
Special requests; and
Booking history.
2.3 Health, Safety and Accessibility Information
Where reasonably necessary to arrange an experience safely, we may collect information relating to:
Allergies;
Dietary requirements;
Mobility needs;
Medical conditions relevant to participation;
Pregnancy;
Fitness level;
Swimming ability;
Medication or emergency needs; and
Accessibility requirements.
We request that you provide only information genuinely relevant to the booking or your safety.
Where applicable, we will request explicit consent or rely on another lawful basis permitted by Omani law before processing sensitive personal data.
2.4 Emergency Contact Information
We may collect the name, relationship and contact information of a person to contact in an emergency.
You should ensure that you have permission to provide another person’s details.
2.5 Payment and Transaction Information
We may collect:
Amounts paid;
Currency;
Payment status;
Transaction references;
Billing details;
Refund information; and
Limited payment-method information.
Full card details may be processed directly by an independent payment provider rather than stored by Mystical Trips.
2.6 Communications
We may retain communications sent through:
Email;
Website forms;
WhatsApp;
SMS;
Telephone;
Social media; and
Booking platforms.
This may include questions, preferences, instructions, complaints and feedback.
2.7 Website and Technical Information
When you use our website, we or our service providers may collect:
Internet Protocol address;
Browser type;
Device type;
Operating system;
Approximate location;
Pages visited;
Referral source;
Date and time of access;
Website interactions;
Cookie identifiers; and
Diagnostic or security data.
2.8 Photographs, Videos and Testimonials
With appropriate notice or consent, we may collect:
Photographs or videos taken during an experience;
Reviews;
Testimonials;
Social-media tags; and
Feedback forms.
3. HOW WE COLLECT PERSONAL DATA
We may collect personal data:
Directly From You
For example, when you:
Complete a website form;
Contact us by email or WhatsApp;
Request a quotation;
Confirm a booking;
Make payment;
Participate in an experience;
Submit feedback; or
Subscribe to communications.
From the Lead Booker
A person making a group booking may supply information about other participants.
From Third Parties
We may receive information from:
Travel agents;
Hotels;
Booking platforms;
Payment providers;
Activity partners;
Referral partners;
Social-media platforms; or
Other service providers involved in your booking.
Automatically
Certain technical information may be collected through cookies, server logs, analytics technologies and website-security tools.
4. PURPOSES FOR WHICH WE USE PERSONAL DATA
We may use personal data to:
Respond to Enquiries
To understand your request, communicate with you and prepare a suitable response.
Prepare Quotations and Itineraries
To design a proposed private experience based on your dates, interests, group size and needs.
Confirm and Manage Bookings
To process reservations, payments, changes, cancellations, refunds and operational arrangements.
Deliver Experiences
To organize transport, guides, attractions, meals, activities, permits, meeting points and other agreed services.
Protect Health and Safety
To assess suitability, arrange reasonable support, respond to emergencies and communicate relevant information to guides or service providers.
Process Payments
To issue invoices, confirm transactions, process refunds and maintain financial records.
Communicate Service Information
To provide confirmations, reminders, meeting instructions, itinerary updates, weather alerts and safety notices.
Improve Our Services
To evaluate enquiries, guest feedback, service performance, website activity and customer preferences.
Maintain Security
To prevent fraud, protect our website, verify payments and investigate suspicious or unlawful activity.
Meet Legal Obligations
To maintain records, respond to lawful requests and comply with applicable tax, accounting, consumer-protection, tourism, safety and data-protection requirements.
Manage Complaints and Legal Claims
To investigate complaints, resolve disputes, enforce agreements and protect legal rights.
Conduct Marketing
With any consent required by law, we may send news, travel inspiration, service updates or promotional communications.
5. LEGAL BASIS FOR PROCESSING
Depending on the circumstances and applicable law, we may process personal data because:
You have given consent;
Processing is necessary to respond to your request;
Processing is necessary to prepare or perform a contract;
Processing is required by law;
Processing is necessary to protect a person’s vital interests;
Processing is needed to establish, exercise or defend legal rights; or
Another lawful basis permitted under applicable Omani law applies.
Where consent is the basis of processing, you may withdraw it, subject to legal and operational limitations.
Withdrawal of consent will not affect processing that was lawful before withdrawal.
6. SENSITIVE PERSONAL DATA
Information relating to health and certain other categories may be considered sensitive personal data.
We will seek to:
Collect only what is necessary;
Explain why it is required;
Restrict access to those who need it;
Obtain explicit consent where required;
Apply appropriate safeguards; and
Retain it only for as long as reasonably necessary.
Certain categories of personal data may require regulatory approval or additional safeguards under applicable Omani law.
7. CHILDREN’S PERSONAL DATA
We may process information about children where they are included in a family or group booking.
A parent, guardian or authorized adult must provide or approve the information.
We do not knowingly collect children’s information for independent marketing purposes without appropriate authorization.
Where photographs or promotional material identify a child, we will seek appropriate permission from the parent or guardian.
8. SHARING PERSONAL DATA
We may share personal data only where reasonably necessary and legally permitted.
Recipients may include:
Guides, Drivers and Operational Staff
To deliver the experience and address relevant safety or accessibility needs.
Hotels, Camps, Restaurants and Activity Providers
To reserve and provide requested services.
Transport Providers
To arrange collection, transfers and journey requirements.
Payment Providers and Banks
To process payments, refunds and fraud checks.
Website and Technology Providers
To host the website, manage enquiries, store data, provide analytics, protect security and support communication systems.
Professional Advisers
Including accountants, auditors, insurers and legal advisers.
Government and Regulatory Authorities
Where required by law, legal process, licensing rules, safety obligations or a valid authority request.
Emergency Services
Where necessary to protect health, safety or vital interests.
Business Successors
If the business is reorganized, transferred, merged or sold, subject to appropriate confidentiality and legal safeguards.
We do not sell personal data to advertisers or unrelated third parties.
9. INTERNATIONAL DATA TRANSFERS
Some website, communications, cloud-storage, payment, analytics or booking service providers may process data outside the Sultanate of Oman.
Before transferring personal data internationally, Mystical Trips will take the steps required under applicable Omani law. Depending on the circumstances, this may include:
Informing you of the proposed transfer;
Obtaining explicit consent;
Assessing the receiving party and destination;
Applying contractual safeguards;
Limiting the information transferred; and
Implementing appropriate security measures.
You may contact us for further information about relevant international transfers.
10. DATA RETENTION
We retain personal data only for as long as reasonably necessary for the purpose for which it was collected and to meet legal, accounting, safety and dispute-resolution requirements.
Retention periods may vary according to the type of information.
For example:
Enquiry information may be retained for 1 Year;
Booking and invoice records may be retained for the period required by applicable law;
Safety or incident records may be retained while a claim could reasonably arise;
Marketing information may be retained until consent is withdrawn or the information becomes unnecessary;
Website security logs may be retained for a limited technical period; and
Photographs used with permission may be retained until no longer required or consent is validly withdrawn, subject to prior lawful use.
When information is no longer required, we may securely delete, destroy or anonymize it.
11. DATA SECURITY
Mystical Trips uses reasonable organizational, technical and physical safeguards appropriate to the nature of the personal data processed.
Measures may include:
Access controls;
Password protection;
Device security;
Secure payment providers;
Limited staff access;
Confidentiality requirements;
Data backups;
Software updates;
Secure deletion; and
Procedures for responding to security incidents.
No online system or method of electronic storage can be guaranteed to be completely secure. You should use caution when sending information electronically and should contact us immediately if you suspect unauthorized use of your information.
12. PERSONAL-DATA BREACHES
Where a personal-data breach occurs, Mystical Trips will assess the incident and take reasonable steps to contain and investigate it.
Where required by applicable law, we will notify the relevant authority and affected individuals within the applicable period.
13. YOUR PERSONAL-DATA RIGHTS
Subject to applicable Omani law and any permitted exemptions, you may have the right to:
Be informed about the processing of your personal data;
Request access to personal data held about you;
Request correction of inaccurate or incomplete data;
Request updating of your information;
Request deletion of data in appropriate circumstances;
Request restriction or cessation of certain processing;
Withdraw consent;
Object to certain processing;
Request transfer of data where applicable;
Obtain information regarding a personal-data breach affecting you;
Complain to the relevant authority; and
Exercise other rights available under applicable law.
These rights are not absolute. We may need to retain or process information where required by law, necessary to perform a contract, protect safety, resolve a dispute or establish legal rights.
14. HOW TO EXERCISE YOUR RIGHTS
To submit a privacy request, contact:
Privacy Email: contact@mysticaltrips.com
Telephone: +968 99855885
Please clearly describe your request.
We may ask for information necessary to verify your identity and protect personal data from unauthorized disclosure.
We will respond within the period required by applicable law or, where no specific period applies, within a reasonable timeframe.
We will not normally charge for a reasonable privacy request, but a fee may apply where legally permitted and a request is repetitive, excessive or manifestly unfounded.
15. MARKETING COMMUNICATIONS
We may send promotional communications where:
You have requested them;
You have given any consent required by law; or
Another lawful basis applies.
Marketing messages may include travel inspiration, company news, seasonal information and updates about future experiences.
You may unsubscribe at any time by:
Using the unsubscribe option in the message;
Replying with an unsubscribe request; or
Contacting us at [insert email].
You may still receive essential booking and service communications after opting out of marketing.
16. COOKIES
Our website may use cookies and similar technologies.
Cookies are small data files stored on your device. They may help the website:
Function correctly;
Remember preferences;
Understand website usage;
Improve performance;
Protect against fraud; and
Support relevant marketing.
Cookies may be:
Essential Cookies
Required for website functionality, security or booking features.
Preference Cookies
Used to remember settings such as language or region.
Analytics Cookies
Used to understand how visitors interact with the website.
Marketing Cookies
Used to measure campaigns or support personalized advertising, where enabled and legally permitted.
Where required, non-essential cookies will be used only after obtaining consent.
You can manage cookies through the website consent tool or browser settings. Blocking certain cookies may affect website functionality.
17. ANALYTICS
We may use website analytics to understand:
Visitor numbers;
Page views;
Traffic sources;
Device types;
General geographic regions; and
How users navigate the website.
Analytics data may be aggregated or pseudonymized where practical.
Details of analytics providers should be listed in the final cookie notice once the website’s tools are confirmed.
18. SOCIAL MEDIA
Mystical Trips may operate accounts on social-media platforms.
When you interact with those accounts, the platform may independently collect and process your information under its own privacy policy.
We may view information that you make publicly available and may respond to messages, comments, tags or reviews.
Please avoid posting confidential booking, payment, passport or health information publicly.
19. THIRD-PARTY WEBSITES AND PLATFORMS
Our website may link to maps, payment gateways, booking platforms, social networks and other third-party services.
Those services operate independently and may have their own terms and privacy practices.
Mystical Trips is not responsible for how an independent third party processes data after you leave our website or choose to use its service.
20. PHOTOGRAPHY, VIDEO AND PROMOTIONAL CONTENT
Where we wish to use an identifiable guest’s photograph, video, testimonial or story for promotional purposes, we will seek appropriate permission where required.
Permission may cover use on:
Our website;
Social-media accounts;
Online advertising;
Digital brochures;
Printed promotional material; and
Other agreed channels.
You may decline without affecting your booking.
You may contact us to withdraw consent for future use. Withdrawal may not require us to recall or remove material already lawfully printed, distributed or incorporated into completed publications.
21. AUTOMATED DECISION-MAKING
Mystical Trips does not currently intend to make decisions producing significant legal or similar effects solely through automated processing.
If this changes, this Privacy Policy will be updated and any notice or consent required by law will be provided.
22. ACCURACY OF YOUR INFORMATION
Please ensure that the personal data you provide is accurate and current.
Notify us promptly if your:
Contact details change;
Travel plans change;
Health or mobility needs change; or
Emergency contact information changes.
Incorrect or incomplete information may affect our ability to respond to an enquiry or deliver an experience safely.
23. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy to reflect changes in:
Applicable law;
Regulatory guidance;
Our services;
Website technology;
Business operations; or
Data-processing practices.
The updated version will be posted on the website with a revised “Last Updated” date.
Where a material change affects existing consent or significantly changes how personal data is used, we will provide further notice where appropriate.
24. COMPLAINTS
Please contact us first if you have a concern about how your personal data has been handled.
We will investigate the concern and attempt to resolve it fairly.
You may also have the right to submit a complaint to the relevant personal-data protection authority in the Sultanate of Oman.
Mystical Trips Privacy Contact
Email: contact@mysticaltrips.com
25. CONTACT US
For questions about this Privacy Policy or our personal-data practices, contact:
Mystical Trips
Privacy Email: contact@mysticaltrips.com
LEGAL DISCLAIMER
Mystical Trips provides private guided experiences in the Sultanate of Oman. Routes, timings and activities may change because of weather, road conditions, attraction availability, safety requirements or circumstances beyond our control. Guests are responsible for ensuring that they are suitably prepared, medically fit and adequately insured for their selected experience. Please review our Terms and Conditions and Privacy Policy before booking.