Privacy Policy
Effective 22 October 2026
Who we are
Attractions4Us LLC operates stpatrickstours.com and is responsible for the personal information described in this policy. Where the GDPR or UK GDPR applies, we are the data controller for our handling of that information. This policy covers this website, bookings made through it, and our email and telephone support.
Contact us at reservations@stpatrickstour.com, +1 917 935 4412, or Attractions4Us LLC, 1001 Avenue of the Americas, 4th Floor, New York, NY 10018, USA.
Information we collect
- Bookings: your name, email address, telephone number, selected experience, travel date and time, party size and any traveller details required for that experience. An operator may request additional information such as pickup details, children's age bands or accessibility requirements.
- Payments: payment details are entered into the hosted checkout and processed by its payment provider. We do not receive or store your full card number. We may receive transaction confirmations, amounts, currency and limited payment details needed to reconcile payments or process refunds.
- Enquiries: information you choose to send by email or give us by telephone, including your contact details, preferred visit date, group size and correspondence.
- Technical information: hosting and booking services receive information such as your IP address, requested page, timestamps, browser, device and referring page when you use them.
We obtain information from you, your browser, booking confirmations and updates, and the operator delivering your experience. There is no account registration on this website.
Group enquiries
The group enquiry form prepares an email on your device. Preparing or copying the enquiry does not submit it to us. We receive it only after you send it through your email application. The form does not upload its contents to our website server. Your email provider handles the message under its own privacy terms.
Please provide only information needed to arrange your visit. Do not include payment card numbers, passport copies or unnecessary medical information in an enquiry. If an experience requires additional information, we will explain how to provide it.
Passport day planner
When you build a day, we process your visit date, party size, children’s ages and preferred pace to find suitable ticket categories, available times and prices. Choosing checkout sends your selected experiences and an anonymous booking-session identifier to our booking service so we can prepare your cart. Passport does not collect names, contact details or payment details; you enter those later in hosted checkout.
Your browser stores booking-session and checkout-recovery information to keep your cart connected and prevent duplicate ticket additions. Passport recovery information expires after 24 hours. Our server keeps hashed session references and checkout-attempt records for this same purpose; these records are scheduled for deletion after 24 hours, with removal subject to the hosting provider’s deletion process. Short-lived price quotes expire after five minutes. Hashed network identifiers are used for short-term abuse prevention.
How we use information
We use information to arrange and administer bookings, issue confirmations, communicate changes, answer enquiries, process cancellations and refunds, maintain accounting records, prevent fraud and abuse, troubleshoot services, and establish or defend legal claims. Booking information is necessary to fulfil a reservation; information in a general enquiry is provided voluntarily.
Where the GDPR or UK GDPR applies, our legal bases are performance of a contract or steps requested before entering a contract, compliance with legal obligations, and legitimate interests in running and protecting our booking and customer support services. Where processing requires consent, consent is the applicable basis and may be withdrawn without affecting earlier lawful processing. We do not send marketing emails under our current service.
International transfers
We are based in the United States and this website is hosted in the United States. Service providers and operators may process information in other countries. Where applicable data protection law requires a safeguard for a transfer, we rely on an appropriate safeguard, such as the European Commission's Standard Contractual Clauses with the UK Addendum where relevant, or a permitted transfer necessary to perform the booking contract you request. Contact us for information about the safeguard applicable to a particular transfer.
Retention and security
Our company retention policy keeps booking and transaction records for seven years from travel, and email or telephone enquiries that do not lead to a booking for 24 months after the last message. Relevant records may be retained longer for a legal obligation or an ongoing claim. Technical records and third-party cookies are retained for the purposes and periods applicable to the service concerned.
This website uses HTTPS. Full payment card details are captured in hosted checkout rather than our website systems. Access to operational and booking records is limited to people who need it to provide reservations and support. No method of transmission or storage is completely secure. Where the law requires notification of a personal data breach, we will notify the relevant people and authorities within the applicable time limits.
Your privacy rights
Depending on applicable law, you may request access to your information, correction, deletion, a portable copy, restriction of processing, or an objection to processing based on legitimate interests. You may withdraw consent where processing is based on consent. Certain records must still be retained to meet legal obligations or resolve claims.
Email reservations@stpatrickstour.com with your request and the email address or booking reference needed to locate your records. We may verify your identity before acting. An authorised agent may act with proof of authority. We will not discriminate against you for exercising a privacy right. We respond within the applicable legal period: generally one month under the GDPR or 45 days for applicable US state requests, with extensions only where permitted.
California and other US states
Information described above includes identifiers, customer and commercial records, and internet or network activity. It is disclosed for the purposes and to the recipients described in this policy. Where applicable, you have rights to know, correct and delete information, opt out of sale or sharing and targeted advertising, and limit certain uses of sensitive information. We do not knowingly sell or share information about anyone under 16, and we do not use personal information for profiling that produces legal or similarly significant effects.
If your state provides an appeal right, reply to a refused request with the word “appeal” and your reasons. We will respond within 45 days and explain how to contact the appropriate state authority if you remain dissatisfied. We do not disclose information to third parties for their own direct email marketing.
EEA, UK and Switzerland
You may also complain to your local data protection authority. In the UK this is the Information Commissioner's Office; in the EEA it is the authority for the country where you live or work, or where the issue arose.
Children's information
This website is intended for adults. Children cannot make bookings, and we do not knowingly collect personal information directly from children under 13. An adult booking for children supplies only the traveller information required for the experience. Contact us if you believe a child has provided information directly so we can address it.
Changes and contact
We update this policy when our practices or legal requirements change. The effective date identifies the current version. We will provide notice of material changes and seek consent where required. For privacy questions, contact reservations@stpatrickstour.com or +1 917 935 4412. See also our Terms of Service.